aee518eb05faff9dc03cdef79c302dc1247825a0ca2b322a604bc202f4ccb5a4

Analysis

max time kernel
120s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 00:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-04-30_83337e7d34e7f22c405ba6bae7303b42_cryptolocker.exe
Size

34KB
MD5

83337e7d34e7f22c405ba6bae7303b42
SHA1

c673f0aa2a268c74fb853589dcbd05c1df07c439
SHA256

aee518eb05faff9dc03cdef79c302dc1247825a0ca2b322a604bc202f4ccb5a4
SHA512

1c66aa5372de0ed2869e67915e1b9a62e692bb3eb6a599716c7d2f10a5fdf4f3a0d958892f77d72551c7f28b73df5fce626b001b189d6a62b759401a8104a150
SSDEEP

384:bAvMaNGh4z7CG3POOvbRSLoF/F0QU5XYFnufc/zzo6cuM9gxrOIw6:bAvJCYOOvbRPDEgXRcuM9gxi6

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000700000002327c-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	2024-04-30_83337e7d34e7f22c405ba6bae7303b42_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	demka.exe

Executes dropped EXE 1 IoCs

pid	Process
2404	demka.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2404	2488	2024-04-30_83337e7d34e7f22c405ba6bae7303b42_cryptolocker.exe	83
PID 2488 wrote to memory of 2404	2488	2024-04-30_83337e7d34e7f22c405ba6bae7303b42_cryptolocker.exe	83
PID 2488 wrote to memory of 2404	2488	2024-04-30_83337e7d34e7f22c405ba6bae7303b42_cryptolocker.exe	83

C:\Users\Admin\AppData\Local\Temp\2024-04-30_83337e7d34e7f22c405ba6bae7303b42_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-30_83337e7d34e7f22c405ba6bae7303b42_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Users\Admin\AppData\Local\Temp\demka.exe
  "C:\Users\Admin\AppData\Local\Temp\demka.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\demka.exe

Filesize
35KB

MD5
b0a710ceae248ce4094d9d7bd214f598

SHA1
c743a41a4261f4c3e1128a2b14fd201348e35cd4

SHA256
326e91e59df8431b6f8f450d9c2bcd00bb150b455e80152f6b27b31f2148e333

SHA512
f51e105d74ea68f86f26b9be1a2caee3e0f0ebac523a183884090c607eb01400587d13d62152353a1a4ff2ce2351add9660e800b652c01dca2d23d4c8c5bb04c

Download Submit
memory/2404-25-0x0000000002190000-0x0000000002196000-memory.dmp

Filesize
24KB

Download
memory/2488-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/2488-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2488-8-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download