c1e9b967296cb954c1cd34de10993f81a7d8726c1e3314cf66ae49703a0a30aa

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-09-2024 02:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-07_f3516444e2415804e31e1a5c6365ce89_cryptolocker.exe
Size

32KB
MD5

f3516444e2415804e31e1a5c6365ce89
SHA1

50e231f71a8923e4f120b32195e6ba2f65e38e5d
SHA256

c1e9b967296cb954c1cd34de10993f81a7d8726c1e3314cf66ae49703a0a30aa
SHA512

ff99375469170b7b86bf35ead3d235f6c01d2ec4c4c3873f7ed0894be63b8d4ac3784cdc9606029052e4d2f354222af034a76bbc07202b03c789557bf9006b73
SSDEEP

384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zznum+U8Ss87vhicc:b/yC4GyNM01GuQMNXum+NSnicc

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	2024-09-07_f3516444e2415804e31e1a5c6365ce89_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3020	retln.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	retln.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-07_f3516444e2415804e31e1a5c6365ce89_cryptolocker.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 3020	3052	2024-09-07_f3516444e2415804e31e1a5c6365ce89_cryptolocker.exe	84
PID 3052 wrote to memory of 3020	3052	2024-09-07_f3516444e2415804e31e1a5c6365ce89_cryptolocker.exe	84
PID 3052 wrote to memory of 3020	3052	2024-09-07_f3516444e2415804e31e1a5c6365ce89_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-09-07_f3516444e2415804e31e1a5c6365ce89_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-07_f3516444e2415804e31e1a5c6365ce89_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Users\Admin\AppData\Local\Temp\retln.exe
  "C:\Users\Admin\AppData\Local\Temp\retln.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\retln.exe

Filesize
32KB

MD5
b417dd39fb85a3512cd467478bc931d8

SHA1
f4f70676210cdd8173d0543f8abd1863d6846b1b

SHA256
af23d8cdb3c79030622fe9ab287017963093c9168b83d5b66962576c15460f95

SHA512
916b11efef82b76c59f632e3a5b21c0044a020e0e42aa9c374c359c0321dedc65f040524c26636fbf7df36231bf9fac935a236a18d609bb6d452666c7e4cb4d4

Download Submit
memory/3020-25-0x0000000001F80000-0x0000000001F86000-memory.dmp

Filesize
24KB

Download
memory/3052-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/3052-1-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/3052-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download