7b8d94d3da4c8add885f9541a133bf4c55195bbd477967608f158d1c8db5452a

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 03:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-10-09_5fe8a00c08dd147eea0582a4b59e49c2_cryptolocker.exe
Size

32KB
MD5

5fe8a00c08dd147eea0582a4b59e49c2
SHA1

590f169de3722c336383fc8790a8056999dd3869
SHA256

7b8d94d3da4c8add885f9541a133bf4c55195bbd477967608f158d1c8db5452a
SHA512

9a8d05337713d5feb0da7d52ea179a94b2fc0b62eeaa8338fc87a6b2ab33e974e6e753dac4b89ee49f357d1e9ad8304d5e645c8164464d831195e1778884f3d9
SSDEEP

384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzzcYgUPSznHzl6Au2V:b/yC4GyNM01GuQMNXw2PSjHb

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	2024-10-09_5fe8a00c08dd147eea0582a4b59e49c2_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2804	retln.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-09_5fe8a00c08dd147eea0582a4b59e49c2_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	retln.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4172 wrote to memory of 2804	4172	2024-10-09_5fe8a00c08dd147eea0582a4b59e49c2_cryptolocker.exe	86
PID 4172 wrote to memory of 2804	4172	2024-10-09_5fe8a00c08dd147eea0582a4b59e49c2_cryptolocker.exe	86
PID 4172 wrote to memory of 2804	4172	2024-10-09_5fe8a00c08dd147eea0582a4b59e49c2_cryptolocker.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-10-09_5fe8a00c08dd147eea0582a4b59e49c2_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-09_5fe8a00c08dd147eea0582a4b59e49c2_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Users\Admin\AppData\Local\Temp\retln.exe
  "C:\Users\Admin\AppData\Local\Temp\retln.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\retln.exe

Filesize
32KB

MD5
df292c48db538be3a82a8f4d9781d804

SHA1
ec65843f9244f844a9689e144892d6a771776419

SHA256
f1083016751372001d4359f841dd5475477e7573ea2cbbd926b4a5738662e204

SHA512
7fb74badfb04030533fc8b3ca913b2e9657722963b5ace9cc00f00eac1209f3eead06054ef5c88c45214f29d1cf1b80ac8901f9f56249976b09b4a7beb9f93aa

Download Submit
memory/2804-19-0x0000000002120000-0x0000000002126000-memory.dmp

Filesize
24KB

Download
memory/4172-0-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/4172-1-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/4172-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download