181d1e3efee37d1f70c67904cff28d3e171cea6600ef19107b6f619a6aa56fd4

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-04-2024 10:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-06_6b14fe6cfea2c343ca09668ea28e8d36_cryptolocker.exe
Size

36KB
MD5

6b14fe6cfea2c343ca09668ea28e8d36
SHA1

f1fa3b913e53d52f593997f30e5e1cc85d8777d7
SHA256

181d1e3efee37d1f70c67904cff28d3e171cea6600ef19107b6f619a6aa56fd4
SHA512

02c65e0db2b1fb7682ac62d556d4cdf3880f60975df92920c4932a13128c51aad2c3f90237ccec418e29764eee9f1d6160a5ab537b759bbc913fc102575037e0
SSDEEP

384:bAvMaNGh4z7CG3POOvbRSLoF/F0QU5XYFnufc/zzo6c3l8Sz960SPluhL:bAvJCYOOvbRPDEgXRc3SSz3SPG

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000800000002322a-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	2024-04-06_6b14fe6cfea2c343ca09668ea28e8d36_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	demka.exe

Executes dropped EXE 1 IoCs

pid	Process
4788	demka.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 4788	4692	2024-04-06_6b14fe6cfea2c343ca09668ea28e8d36_cryptolocker.exe	88
PID 4692 wrote to memory of 4788	4692	2024-04-06_6b14fe6cfea2c343ca09668ea28e8d36_cryptolocker.exe	88
PID 4692 wrote to memory of 4788	4692	2024-04-06_6b14fe6cfea2c343ca09668ea28e8d36_cryptolocker.exe	88

C:\Users\Admin\AppData\Local\Temp\2024-04-06_6b14fe6cfea2c343ca09668ea28e8d36_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-06_6b14fe6cfea2c343ca09668ea28e8d36_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Users\Admin\AppData\Local\Temp\demka.exe
  "C:\Users\Admin\AppData\Local\Temp\demka.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\demka.exe

Filesize
36KB

MD5
9e3f5a493d3267d68bce5d89968ecaad

SHA1
49d5f142449c318641e915d841b3716e78c4d09d

SHA256
efee0083aaf76c0454aca5e22267fd36c2d9d38989538cbf56035253ec25d91a

SHA512
acc850acd57b0d7cf8eb86fa0f19421a8ef6337e63820b04368b2804a3a7984964936f5cf1f1dbb94171d3e8e7cb34be64782b6a83bfda29f841f4f7ddb48ec4

Download Submit
memory/4692-0-0x0000000002090000-0x0000000002096000-memory.dmp

Filesize
24KB

Download
memory/4692-1-0x0000000002090000-0x0000000002096000-memory.dmp

Filesize
24KB

Download
memory/4692-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4788-17-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download