d2fb1a19451ebbd1693411519a1524f53bc4859b25ac30455da76de8409909d5

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2024, 05:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-10-15_d3774e1feda2464599713047d6eba9c6_cryptolocker.exe
Size

44KB
MD5

d3774e1feda2464599713047d6eba9c6
SHA1

41ef8a24bd925ee65b225a883edcbcc84ca98210
SHA256

d2fb1a19451ebbd1693411519a1524f53bc4859b25ac30455da76de8409909d5
SHA512

80c2fbc943625b1867cbc9e01f933a270947a3fc6550366e33b255b3878d774062fa974bfcc11c33bf004e410a16b975a87210c3e1c4ba703949fa03922f96d4
SSDEEP

768:bQyC4GyNM01GuQMNXwXOQ69zbjlAAX5e9z8V:bQpYayGiAizbR9XwzU

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	2024-10-15_d3774e1feda2464599713047d6eba9c6_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1148	retln.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-15_d3774e1feda2464599713047d6eba9c6_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	retln.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 1148	644	2024-10-15_d3774e1feda2464599713047d6eba9c6_cryptolocker.exe	84
PID 644 wrote to memory of 1148	644	2024-10-15_d3774e1feda2464599713047d6eba9c6_cryptolocker.exe	84
PID 644 wrote to memory of 1148	644	2024-10-15_d3774e1feda2464599713047d6eba9c6_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-10-15_d3774e1feda2464599713047d6eba9c6_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-15_d3774e1feda2464599713047d6eba9c6_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:644
- C:\Users\Admin\AppData\Local\Temp\retln.exe
  "C:\Users\Admin\AppData\Local\Temp\retln.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\retln.exe

Filesize
44KB

MD5
ce691dbf53b750efa849d95f99024167

SHA1
88a51e8268345372c08da4fcd23ab4e9a1526e6a

SHA256
ffddf14cc3324fcdea7c585709ebdb3065aa8700714c57bac7b16e8547bbe36a

SHA512
06b748fc57178f5bc88e03865a144a99391ee1e5bb83bf17b9922f1f3eadc53940bebb9fce4a63cc8217915168e74f34bcffcddb279a038a352b20c5053f9749

Download Submit
memory/644-0-0x00000000021D0000-0x00000000021D6000-memory.dmp

Filesize
24KB

Download
memory/644-1-0x00000000021D0000-0x00000000021D6000-memory.dmp

Filesize
24KB

Download
memory/644-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1148-19-0x0000000002100000-0x0000000002106000-memory.dmp

Filesize
24KB

Download