b220bf0b156fceae44794e60004c5face75bf6f7530adc237a0296dfd5b47fde

Analysis

max time kernel
186s
max time network
205s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 05:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-09_1debb3aa97aee3eeb5f04f609e20e13b_cryptolocker.exe
Size

28KB
MD5

1debb3aa97aee3eeb5f04f609e20e13b
SHA1

ecffb4d5dc85fb435c7a8530a62c2972999801cf
SHA256

b220bf0b156fceae44794e60004c5face75bf6f7530adc237a0296dfd5b47fde
SHA512

f834dfb6fa367769019ffcb6d2c0ddac12eb1143edcfa0b89168a51c335fa70677250d526cd58c8b3b6b87cb311d5740a64226ed2b533c716a73fd0c197fc88d
SSDEEP

384:bAvMaNGh4z7CG3POOvbRSLoF/F0QU5XYFnufc/zzo6cuK:bAvJCYOOvbRPDEgXRcb

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	demka.exe
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	2024-01-09_1debb3aa97aee3eeb5f04f609e20e13b_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2760	demka.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2760	2468	2024-01-09_1debb3aa97aee3eeb5f04f609e20e13b_cryptolocker.exe	91
PID 2468 wrote to memory of 2760	2468	2024-01-09_1debb3aa97aee3eeb5f04f609e20e13b_cryptolocker.exe	91
PID 2468 wrote to memory of 2760	2468	2024-01-09_1debb3aa97aee3eeb5f04f609e20e13b_cryptolocker.exe	91

C:\Users\Admin\AppData\Local\Temp\2024-01-09_1debb3aa97aee3eeb5f04f609e20e13b_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-09_1debb3aa97aee3eeb5f04f609e20e13b_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Users\Admin\AppData\Local\Temp\demka.exe
  "C:\Users\Admin\AppData\Local\Temp\demka.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\demka.exe

Filesize
28KB

MD5
709128f52bd0f2182437027140862d79

SHA1
0e71f8bc79e88b964c073e41ee51bb3ef9d07831

SHA256
e85db29a881464dd29b816627c62e2fb586b401d67217cd0dd489ff536e21411

SHA512
bc3def61abd08ceaf5fdd62addbad0697e8ec6aa8a882db9afc4d2e268cac06aace7ca1e23dfe4280fe103300ab6048575f5ddd2ed50708738c1294bfc4e0bdc

Download Submit
memory/2468-0-0x0000000002340000-0x0000000002346000-memory.dmp

Filesize
24KB

Download
memory/2468-1-0x0000000002340000-0x0000000002346000-memory.dmp

Filesize
24KB

Download
memory/2468-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2760-21-0x0000000002D60000-0x0000000002D66000-memory.dmp

Filesize
24KB

Download