e5d70a5978c7d40ead16ecb02b87b94149a40b2355fe2f114aa75bb567bb4fea

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
18-01-2024 23:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-18_d0149c06b30d7b759441293670700970_cryptolocker.exe
Size

28KB
MD5

d0149c06b30d7b759441293670700970
SHA1

8acde192194db362432709d08fb21a5c56783f67
SHA256

e5d70a5978c7d40ead16ecb02b87b94149a40b2355fe2f114aa75bb567bb4fea
SHA512

5ffac0c69c38b5da76c0c63451a45291c61d04225529eca060a7676037402e3747935dec277ebe1b5e8e5443577bb87b8102e615d029bd817c0cabd124488c5e
SSDEEP

384:bAvMaNGh4z7CG3POOvbRSLoF/F0QU5XYFnufc/zzo6cu7O1:bAvJCYOOvbRPDEgXRcn

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000600000001e5df-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	2024-01-18_d0149c06b30d7b759441293670700970_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	demka.exe

Executes dropped EXE 1 IoCs

pid	Process
2448	demka.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 2448	4412	2024-01-18_d0149c06b30d7b759441293670700970_cryptolocker.exe	26
PID 4412 wrote to memory of 2448	4412	2024-01-18_d0149c06b30d7b759441293670700970_cryptolocker.exe	26
PID 4412 wrote to memory of 2448	4412	2024-01-18_d0149c06b30d7b759441293670700970_cryptolocker.exe	26

C:\Users\Admin\AppData\Local\Temp\2024-01-18_d0149c06b30d7b759441293670700970_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-18_d0149c06b30d7b759441293670700970_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Users\Admin\AppData\Local\Temp\demka.exe
  "C:\Users\Admin\AppData\Local\Temp\demka.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\demka.exe

Filesize
29KB

MD5
d43c2dd382fa19b58c386a3b18f0779c

SHA1
6f4090bc0d405472a8cbb720d184a60c820eabfb

SHA256
a1794bb150d2b9e0352dda4ebb8f1f51271b632d47b0590e9eccd368ab13ed2b

SHA512
030bb5d193990fa1892ec849c8da669e583ba5ba6f7ef1fc56a781716e77e618afa63798e0b5bda502a92534841498d52f10b8c6b8941b34bb7ea05891f4d1d7

Download Submit
memory/2448-20-0x0000000002210000-0x0000000002216000-memory.dmp

Filesize
24KB

Download
memory/4412-0-0x0000000002230000-0x0000000002236000-memory.dmp

Filesize
24KB

Download
memory/4412-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4412-1-0x0000000002230000-0x0000000002236000-memory.dmp

Filesize
24KB

Download