Analysis
-
max time kernel
143s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 17:40
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-25_e532c7ba364526f012989c5f2a7166d0_cryptolocker.exe
Resource
win7-20231215-en
General
-
Target
2024-01-25_e532c7ba364526f012989c5f2a7166d0_cryptolocker.exe
-
Size
31KB
-
MD5
e532c7ba364526f012989c5f2a7166d0
-
SHA1
05c0bc1f599b0ec8a1fbe9d5e3b0446c728b9c48
-
SHA256
83b8c1fb55cec16c3576078b6443e9b2848b444303d75fa181a432c0f9d7cd27
-
SHA512
a8841a06c3ca70a0909cf9c0711e46e2a9e0573db8f3c94a369f97b7779f7a3678dfd44f8c49f2de77822e0d9d11863423ef08a009668ea28ce3aa3c2a7d9066
-
SSDEEP
384:bAvMaNGh4z7CG3POOvbRSLoF/F0QU5XYFnufc/zzo6cuM9Jm:bAvJCYOOvbRPDEgXRcuM9U
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\demka.exe CryptoLocker_rule2 -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2024-01-25_e532c7ba364526f012989c5f2a7166d0_cryptolocker.exedemka.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation 2024-01-25_e532c7ba364526f012989c5f2a7166d0_cryptolocker.exe Key value queried \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation demka.exe -
Executes dropped EXE 1 IoCs
Processes:
demka.exepid process 1848 demka.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
2024-01-25_e532c7ba364526f012989c5f2a7166d0_cryptolocker.exedescription pid process target process PID 5048 wrote to memory of 1848 5048 2024-01-25_e532c7ba364526f012989c5f2a7166d0_cryptolocker.exe demka.exe PID 5048 wrote to memory of 1848 5048 2024-01-25_e532c7ba364526f012989c5f2a7166d0_cryptolocker.exe demka.exe PID 5048 wrote to memory of 1848 5048 2024-01-25_e532c7ba364526f012989c5f2a7166d0_cryptolocker.exe demka.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_e532c7ba364526f012989c5f2a7166d0_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_e532c7ba364526f012989c5f2a7166d0_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\demka.exe"C:\Users\Admin\AppData\Local\Temp\demka.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
PID:1848
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31KB
MD58f9b6156d6ada9bedd80c2c58333f658
SHA1ec5e243f4470970192e5d159daa88becfcda1022
SHA256a3b8eae3248f2d7834b357cdb7e1d56a0689a2e3b34fa3e71a280b2df72fd01e
SHA51261b19e4a8f8ae9e467fca0179140f25e55620b467a67c2f04affa72a043064bded78331c91ff9fa5ef45240bbd14bf24f4e370d4980a1c6a8d9d376e0b885e07