91373d2c09bbfbf7784ea38c9c68fddad2d2f5e578477e076ddfc140c88ff6de

Analysis

max time kernel
153s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 04:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-09_391f214fc4e56de2da8a8642385ff866_cryptolocker.exe
Size

41KB
MD5

391f214fc4e56de2da8a8642385ff866
SHA1

cf17f8892b046791d9b0d03a5043788e9d6b15b1
SHA256

91373d2c09bbfbf7784ea38c9c68fddad2d2f5e578477e076ddfc140c88ff6de
SHA512

e93f88bf5b7b8f31db558407573e6aaad8e4a753fe4506fa2d41c4778a5f7dab93a2c88345750ac6b25858ba5c8af8b3743f1ef6a4b4b27d208e7f8768ef5233
SSDEEP

384:bAvMaNGh4z7CG3POOvbRSLoF/F0QU5XYFnufc/zzoiM8Nekdvjl9V50i3NbZM+iv:bAvJCYOOvbRPDEgXrNekd7l94i3p+b

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023255-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	2024-03-09_391f214fc4e56de2da8a8642385ff866_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	demka.exe

Executes dropped EXE 1 IoCs

pid	Process
3752	demka.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 3752	1128	2024-03-09_391f214fc4e56de2da8a8642385ff866_cryptolocker.exe	100
PID 1128 wrote to memory of 3752	1128	2024-03-09_391f214fc4e56de2da8a8642385ff866_cryptolocker.exe	100
PID 1128 wrote to memory of 3752	1128	2024-03-09_391f214fc4e56de2da8a8642385ff866_cryptolocker.exe	100

C:\Users\Admin\AppData\Local\Temp\2024-03-09_391f214fc4e56de2da8a8642385ff866_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-09_391f214fc4e56de2da8a8642385ff866_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Users\Admin\AppData\Local\Temp\demka.exe
  "C:\Users\Admin\AppData\Local\Temp\demka.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3744 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:1384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\demka.exe

Filesize
41KB

MD5
edb7f5393757c9048cae4d0ceac5aaa0

SHA1
428600dcbdeb9bcc4924e6735f7647375a7400a8

SHA256
9e685d488ffe219883ca99191497c08725b56d6bcde6fc1da0dd7534f46242ba

SHA512
1f21fc46f02b452ff0b723af10336788ab2ab4b4005ac961ae58f84063e3127a25a4c182f525824fc8ec0a790451c56bcc2a19b00b7932bb09dc61741ea8c3ae

Download Submit
memory/1128-0-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/1128-1-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/1128-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3752-18-0x0000000000600000-0x0000000000606000-memory.dmp

Filesize
24KB

Download