9c86bff0f6a0e02806c7c49a591aef9ff97fa1af4e13605f6589e1ec67e85c6f

Analysis

max time kernel
159s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
23-10-2023 20:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.2023-09-09_2760eb39f646b041327238c881eb3219_cryptolocker_JC.exe
Size

35KB
MD5

2760eb39f646b041327238c881eb3219
SHA1

3c946b1b6c64b6d8b5029a551465145091c656ba
SHA256

9c86bff0f6a0e02806c7c49a591aef9ff97fa1af4e13605f6589e1ec67e85c6f
SHA512

40bd8bd297441e347831b5b2fdf243e9aac06d6c1a31a1ea7f9bb7e85a99999192e23ea20999d51cb601ce48c85cc53593cac335c3f6808fc6dbd946bced5780
SSDEEP

384:bAvMaNGh4z7CG3POOvbRSLoF/F0QU5XYFnufc/zzoiM8Nekdvjl9V50i3NbC:bAvJCYOOvbRPDEgXrNekd7l94i3pC

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\Control Panel\International\Geo\Nation	NEAS.2023-09-09_2760eb39f646b041327238c881eb3219_cryptolocker_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
4408	demka.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 4408	4904	NEAS.2023-09-09_2760eb39f646b041327238c881eb3219_cryptolocker_JC.exe	81
PID 4904 wrote to memory of 4408	4904	NEAS.2023-09-09_2760eb39f646b041327238c881eb3219_cryptolocker_JC.exe	81
PID 4904 wrote to memory of 4408	4904	NEAS.2023-09-09_2760eb39f646b041327238c881eb3219_cryptolocker_JC.exe	81

C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-09_2760eb39f646b041327238c881eb3219_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-09_2760eb39f646b041327238c881eb3219_cryptolocker_JC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Users\Admin\AppData\Local\Temp\demka.exe
  "C:\Users\Admin\AppData\Local\Temp\demka.exe"
  2⤵
  - Executes dropped EXE
  PID:4408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\demka.exe

Filesize
35KB

MD5
568322823e291bbb7d50f1d843b88f05

SHA1
b1f0dc2430c0013bacb9cccf3b4792f0dc70efa7

SHA256
4f999671843f1e332eb4b76492c04dc30a109edec7cbf6914e291341f3811b15

SHA512
0eab0eff0654e51a3546eb7dc9a9e7cfb74be9cc4f80c4358813f0ec9cfa9a91044d5d243a3bef9eb32c6d0f9b0a9bf38c693726cff126ef6090b6e15255be62

Download Submit
C:\Users\Admin\AppData\Local\Temp\demka.exe

Filesize
35KB

MD5
568322823e291bbb7d50f1d843b88f05

SHA1
b1f0dc2430c0013bacb9cccf3b4792f0dc70efa7

SHA256
4f999671843f1e332eb4b76492c04dc30a109edec7cbf6914e291341f3811b15

SHA512
0eab0eff0654e51a3546eb7dc9a9e7cfb74be9cc4f80c4358813f0ec9cfa9a91044d5d243a3bef9eb32c6d0f9b0a9bf38c693726cff126ef6090b6e15255be62

Download Submit
C:\Users\Admin\AppData\Local\Temp\demka.exe

Filesize
35KB

MD5
568322823e291bbb7d50f1d843b88f05

SHA1
b1f0dc2430c0013bacb9cccf3b4792f0dc70efa7

SHA256
4f999671843f1e332eb4b76492c04dc30a109edec7cbf6914e291341f3811b15

SHA512
0eab0eff0654e51a3546eb7dc9a9e7cfb74be9cc4f80c4358813f0ec9cfa9a91044d5d243a3bef9eb32c6d0f9b0a9bf38c693726cff126ef6090b6e15255be62

Download Submit
memory/4408-20-0x00000000020A0000-0x00000000020A6000-memory.dmp

Filesize
24KB

Download
memory/4904-0-0x00000000021E0000-0x00000000021E6000-memory.dmp

Filesize
24KB

Download
memory/4904-1-0x00000000021E0000-0x00000000021E6000-memory.dmp

Filesize
24KB

Download
memory/4904-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download