68508bd079e2a0f49cbe77cb03de423a604aa78cebf08464b62cb6424a836005

Analysis

max time kernel
153s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 00:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-06-05_475fd1b455c11f756e46dda3c56f5f88_cryptolocker.exe
Size

31KB
MD5

475fd1b455c11f756e46dda3c56f5f88
SHA1

b0be7a566963640f7d993de44841b31ba459c7e3
SHA256

68508bd079e2a0f49cbe77cb03de423a604aa78cebf08464b62cb6424a836005
SHA512

382f6344fa2285dc68e0e37c7fd8cbf6335d0739f8715f0ac33932e14b3d63107507154ea2c118b631f83f4a87b3c2eb1ea7ee8c32a927b8103506da4b596701
SSDEEP

384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zznum+U8Ss87vhik:b/yC4GyNM01GuQMNXum+NSnik

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000900000002326d-13.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	2024-06-05_475fd1b455c11f756e46dda3c56f5f88_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
5088	retln.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 5088	4504	2024-06-05_475fd1b455c11f756e46dda3c56f5f88_cryptolocker.exe	91
PID 4504 wrote to memory of 5088	4504	2024-06-05_475fd1b455c11f756e46dda3c56f5f88_cryptolocker.exe	91
PID 4504 wrote to memory of 5088	4504	2024-06-05_475fd1b455c11f756e46dda3c56f5f88_cryptolocker.exe	91

C:\Users\Admin\AppData\Local\Temp\2024-06-05_475fd1b455c11f756e46dda3c56f5f88_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-05_475fd1b455c11f756e46dda3c56f5f88_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Users\Admin\AppData\Local\Temp\retln.exe
  "C:\Users\Admin\AppData\Local\Temp\retln.exe"
  2⤵
  - Executes dropped EXE
  PID:5088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:1492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\retln.exe

Filesize
31KB

MD5
50001a7ad6def3d7fbe29928de73b555

SHA1
f243d32e6bd494dd0193d3ac6ac676b8f4a3764c

SHA256
278b9f65be8f6be74db6479604efbbdcaef61a5cab7bccbb1d06c440949918ff

SHA512
41f1133e0012520d602ec7f64cb4c04b29f81c7d852989922dfbbad5cc9d7acde18de958cfdf5d98bc42925e0427e2781c7d1ecc3c5615339f3bbf75a1ea4b6a

Download Submit
memory/4504-0-0x00000000022D0000-0x00000000022D6000-memory.dmp

Filesize
24KB

Download
memory/4504-2-0x00000000022D0000-0x00000000022D6000-memory.dmp

Filesize
24KB

Download
memory/4504-3-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/5088-18-0x0000000002110000-0x0000000002116000-memory.dmp

Filesize
24KB

Download