75dee1835cbd30d95936dd46adab04043acab4cdb681ac002dcfed2f338201f0

Analysis

max time kernel
88s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04-02-2024 00:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-04_ee7845b37f8d3169f978cb968a4a74a6_cryptolocker.exe
Size

36KB
MD5

ee7845b37f8d3169f978cb968a4a74a6
SHA1

2ef1ab22b799b1d8ac7f3434d93a0c30735ebb25
SHA256

75dee1835cbd30d95936dd46adab04043acab4cdb681ac002dcfed2f338201f0
SHA512

15de7d2096d484d1735b9c49caddb189b43fc3d1bfd337e1d935c7c88791145c1e5f6b43005afd114e605cf93d26d35b67a813da68a607de84a0da01c425533a
SSDEEP

384:bAvMaNGh4z7CG3POOvbRSLoF/F0QU5XYFnufc/zzoiM8Nekdvjl9V50i3NbiF:bAvJCYOOvbRPDEgXrNekd7l94i3piF

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000002315e-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	2024-02-04_ee7845b37f8d3169f978cb968a4a74a6_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	demka.exe

Executes dropped EXE 1 IoCs

pid	Process
3104	demka.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 3104	852	2024-02-04_ee7845b37f8d3169f978cb968a4a74a6_cryptolocker.exe	85
PID 852 wrote to memory of 3104	852	2024-02-04_ee7845b37f8d3169f978cb968a4a74a6_cryptolocker.exe	85
PID 852 wrote to memory of 3104	852	2024-02-04_ee7845b37f8d3169f978cb968a4a74a6_cryptolocker.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-02-04_ee7845b37f8d3169f978cb968a4a74a6_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-04_ee7845b37f8d3169f978cb968a4a74a6_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:852
- C:\Users\Admin\AppData\Local\Temp\demka.exe
  "C:\Users\Admin\AppData\Local\Temp\demka.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\demka.exe

Filesize
36KB

MD5
c0e70b5ffa502fc06f49eb05f6ed62d6

SHA1
014afe4bae01a37a223e0995d330a0dd6def7bed

SHA256
ffa102e57bb212bc844ed61b8fa869fc5b56a4663bdd7a428aec74d97f080b81

SHA512
1e3a7a3b9946e101a68c2e65689c04170b656f4acfb487c5582ec37e3918095a3f3e1955e3ad58ab5d5ef948c27ec4164540b2d6e241ede8eed12b53731457cd

Download Submit
memory/852-0-0x0000000002250000-0x0000000002256000-memory.dmp

Filesize
24KB

Download
memory/852-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/852-1-0x0000000002250000-0x0000000002256000-memory.dmp

Filesize
24KB

Download
memory/3104-20-0x0000000002010000-0x0000000002016000-memory.dmp

Filesize
24KB

Download