9a2438d410efe83ec06adff1622ea492ea8c798978c0511836f083e4e4c3199d

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 08:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-14_d351ba21100ae33d68689928b5a1aee2_cryptolocker.exe
Size

43KB
MD5

d351ba21100ae33d68689928b5a1aee2
SHA1

855e218f8acca1f6ee5946a99058e7b2778046d2
SHA256

9a2438d410efe83ec06adff1622ea492ea8c798978c0511836f083e4e4c3199d
SHA512

3b7b3bdbab7105f23b6cfc2a515464bdf5c2d14eb1bdd1e40150731a715de9d083c17e72a28cbee51100427c670bf189abb90d5521cc9bc64bd2c3cdf50f96e8
SSDEEP

768:bQyC4GyNM01GuQMNXwXOQ69zbjlAAX5e9zY:bQpYayGiAizbR9XwzY

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000700000002328e-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	2024-06-14_d351ba21100ae33d68689928b5a1aee2_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3972	retln.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 3972	4852	2024-06-14_d351ba21100ae33d68689928b5a1aee2_cryptolocker.exe	83
PID 4852 wrote to memory of 3972	4852	2024-06-14_d351ba21100ae33d68689928b5a1aee2_cryptolocker.exe	83
PID 4852 wrote to memory of 3972	4852	2024-06-14_d351ba21100ae33d68689928b5a1aee2_cryptolocker.exe	83

C:\Users\Admin\AppData\Local\Temp\2024-06-14_d351ba21100ae33d68689928b5a1aee2_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-14_d351ba21100ae33d68689928b5a1aee2_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Users\Admin\AppData\Local\Temp\retln.exe
  "C:\Users\Admin\AppData\Local\Temp\retln.exe"
  2⤵
  - Executes dropped EXE
  PID:3972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\retln.exe

Filesize
43KB

MD5
687db79d9ca7bf0cacbca4d22a240b9c

SHA1
62b452a50263c86dd6b44c2633d9804af0eeeca7

SHA256
bccc1be0cd2cfe3c8c42b1c2ba4f41db13270897ab10c2cea20e3c6cdedb02c0

SHA512
b02362e57764acc74810a63c6f9cb6a75e92317180c37e303ae33b868d274b6cbde71c07dc13555eaf34d1cdef5c2585d2e45c38592dde0f8bc52b17600f7b53

Download Submit
memory/3972-25-0x00000000004B0000-0x00000000004B6000-memory.dmp

Filesize
24KB

Download
memory/4852-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/4852-8-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/4852-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download