5bb754176a745e7fe20a3402873d8a6d531a329ec72ebc95ceb84fdc4cf3b3fe

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
19/02/2024, 22:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-19_6f931306b5fdea3c0803b4a759793211_cryptolocker.exe
Size

32KB
MD5

6f931306b5fdea3c0803b4a759793211
SHA1

e8553773bc2799731e6876ade3613c4ac899cb82
SHA256

5bb754176a745e7fe20a3402873d8a6d531a329ec72ebc95ceb84fdc4cf3b3fe
SHA512

716a7e1af71801b3db9c84f8f7ca2f768a731bfbf7bd4a7056cc636d22bff412c315abb02c55a0b19f0d6813d229ded95e8d71deba8ea601617992048d45c3eb
SSDEEP

384:bAvMaNGh4z7CG3POOvbRSLoF/F0QU5XYFnufc/zzo6cuM9gpD:bAvJCYOOvbRPDEgXRcuM9gt

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000a00000002312d-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	2024-02-19_6f931306b5fdea3c0803b4a759793211_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	demka.exe

Executes dropped EXE 1 IoCs

pid	Process
4304	demka.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3136 wrote to memory of 4304	3136	2024-02-19_6f931306b5fdea3c0803b4a759793211_cryptolocker.exe	86
PID 3136 wrote to memory of 4304	3136	2024-02-19_6f931306b5fdea3c0803b4a759793211_cryptolocker.exe	86
PID 3136 wrote to memory of 4304	3136	2024-02-19_6f931306b5fdea3c0803b4a759793211_cryptolocker.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-02-19_6f931306b5fdea3c0803b4a759793211_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-19_6f931306b5fdea3c0803b4a759793211_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3136
- C:\Users\Admin\AppData\Local\Temp\demka.exe
  "C:\Users\Admin\AppData\Local\Temp\demka.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\demka.exe

Filesize
32KB

MD5
714773eba46a6127f4d0977129d804f9

SHA1
412e5ecb3174e2a6125dce703e91c42ba2a68201

SHA256
2e3993e83a4fa59be6e9d3481237aee00df3a87f404ee0e826425a38a00f198f

SHA512
ad2a751f3af975ea318b08c303c5a580aec0cf8cb1858dc180cde7094b9bf983f822e2c72fcff3bbe0ba892f7ae8961f9ee82394c5b5a6d675ee066d0340714c

Download Submit
memory/3136-0-0x0000000000730000-0x0000000000736000-memory.dmp

Filesize
24KB

Download
memory/3136-1-0x0000000000730000-0x0000000000736000-memory.dmp

Filesize
24KB

Download
memory/3136-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4304-22-0x0000000002010000-0x0000000002016000-memory.dmp

Filesize
24KB

Download