8f0a706a5198bb7b491eca0fa8af8ef0b7f7fd4f3658da431ecec8176a6acbbb

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
18/08/2023, 13:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2558bea4cce8e29ce69752f95cf80dbc_cryptolocker_JC.exe
Size

34KB
MD5

2558bea4cce8e29ce69752f95cf80dbc
SHA1

db1a5529b9c8803dd33faafe2214c832a1042ddb
SHA256

8f0a706a5198bb7b491eca0fa8af8ef0b7f7fd4f3658da431ecec8176a6acbbb
SHA512

211966ed87db822250ea6c77f318e1275aff223fd7385194ae9185d285e40170f752a55e238eafa74ca362fc2cf1b8f305bf2030ee92245d9767c54cd445c61d
SSDEEP

384:bAvMaNGh4z7CG3POOvbRSLoF/F0QU5XYFnufc/zzoiM8Nekdvjl9V50i3Nt:bAvJCYOOvbRPDEgXrNekd7l94i3H

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2888	demka.exe

Loads dropped DLL 1 IoCs

pid	Process
1964	2558bea4cce8e29ce69752f95cf80dbc_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1964	2558bea4cce8e29ce69752f95cf80dbc_cryptolocker_JC.exe
2888	demka.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2888	1964	2558bea4cce8e29ce69752f95cf80dbc_cryptolocker_JC.exe	28
PID 1964 wrote to memory of 2888	1964	2558bea4cce8e29ce69752f95cf80dbc_cryptolocker_JC.exe	28
PID 1964 wrote to memory of 2888	1964	2558bea4cce8e29ce69752f95cf80dbc_cryptolocker_JC.exe	28
PID 1964 wrote to memory of 2888	1964	2558bea4cce8e29ce69752f95cf80dbc_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\2558bea4cce8e29ce69752f95cf80dbc_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\2558bea4cce8e29ce69752f95cf80dbc_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\demka.exe
  "C:\Users\Admin\AppData\Local\Temp\demka.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\demka.exe

Filesize
34KB

MD5
f4f0b170c27b49c412a78297309e8023

SHA1
e5561d5ccab0ce009489155a386d8fa2efc9c2bd

SHA256
297561fa04b44258be4a2e312c0d997117be3b3242e2ed9208e79188d9b21fae

SHA512
3b115780c533345a19aba4a443afce2af04841c2bfc041fc56af2f05c47cdacad4e87bf73f8341a20255764bae860b30e9b3189c2162f6ae2f015111055e0e90

Download Submit
C:\Users\Admin\AppData\Local\Temp\demka.exe

Filesize
34KB

MD5
f4f0b170c27b49c412a78297309e8023

SHA1
e5561d5ccab0ce009489155a386d8fa2efc9c2bd

SHA256
297561fa04b44258be4a2e312c0d997117be3b3242e2ed9208e79188d9b21fae

SHA512
3b115780c533345a19aba4a443afce2af04841c2bfc041fc56af2f05c47cdacad4e87bf73f8341a20255764bae860b30e9b3189c2162f6ae2f015111055e0e90

Download Submit
\Users\Admin\AppData\Local\Temp\demka.exe

Filesize
34KB

MD5
f4f0b170c27b49c412a78297309e8023

SHA1
e5561d5ccab0ce009489155a386d8fa2efc9c2bd

SHA256
297561fa04b44258be4a2e312c0d997117be3b3242e2ed9208e79188d9b21fae

SHA512
3b115780c533345a19aba4a443afce2af04841c2bfc041fc56af2f05c47cdacad4e87bf73f8341a20255764bae860b30e9b3189c2162f6ae2f015111055e0e90

Download Submit
memory/1964-54-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/1964-56-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/1964-55-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2888-71-0x00000000001F0000-0x00000000001F6000-memory.dmp

Filesize
24KB

Download