c1e6d1c997989936afe1a8104f1b79e73754230e4a94f19d8ea3de0b491a1a4f

Analysis

max time kernel
130s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 04:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-07_6a35618299e4d998979dfd79e132feef_cryptolocker.exe
Size

43KB
MD5

6a35618299e4d998979dfd79e132feef
SHA1

1b77947f1b5165c72298550091213ea779fc2924
SHA256

c1e6d1c997989936afe1a8104f1b79e73754230e4a94f19d8ea3de0b491a1a4f
SHA512

4441e9c7d0b9a2945a02dec36700a0d8fc671e898eeb6ba49e73c167ac6febfd4249540be08fd325c0e706a78c563a806a4d28597a59d38bc3d1e3398c5fc185
SSDEEP

768:bAvJCYOOvbRPDEgXrNekd7l94i3p+kfRh:bAvJCF+RQgJeab4sB3

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000d000000023b24-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation	2024-05-07_6a35618299e4d998979dfd79e132feef_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation	demka.exe

Executes dropped EXE 1 IoCs

pid	Process
804	demka.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 712 wrote to memory of 804	712	2024-05-07_6a35618299e4d998979dfd79e132feef_cryptolocker.exe	83
PID 712 wrote to memory of 804	712	2024-05-07_6a35618299e4d998979dfd79e132feef_cryptolocker.exe	83
PID 712 wrote to memory of 804	712	2024-05-07_6a35618299e4d998979dfd79e132feef_cryptolocker.exe	83

C:\Users\Admin\AppData\Local\Temp\2024-05-07_6a35618299e4d998979dfd79e132feef_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-07_6a35618299e4d998979dfd79e132feef_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:712
- C:\Users\Admin\AppData\Local\Temp\demka.exe
  "C:\Users\Admin\AppData\Local\Temp\demka.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\demka.exe

Filesize
43KB

MD5
86ddb9826ed35c68c2e430c368b0b014

SHA1
4a36a01f0410f9e5deb857d8fcc5e42360e9e28e

SHA256
9a700d57aba31ad820102dc46b3ee071de1c255ae4608b6177002d06edc0b498

SHA512
f9b6816272c753460b42066d535f61baea5b5068fbb46c59c0a40edaa77d9eb1dc85dbb6b5698136b95ebec48387d0dcea204419d7e508a001928053b38ed270

Download Submit
C:\Users\Admin\AppData\Local\Temp\medkem.exe

Filesize
186B

MD5
b27a70502535ee8b0d6d4672b5ec16a5

SHA1
6588a831754da565600d61b7521b51c0acd52e80

SHA256
893d7cd6dca180eb9e66b223ed22f81d7c4327ea336a98a971956ba9f13c9951

SHA512
c4d375e07741fd37066e1e71a3200d2428422b9c90695e7cc5aa7a60c4cb5410566a8a12e26ba276edcb1ca1ade199babd5675adee79b27cdb930b9ca8629a0a

Download Submit
memory/712-0-0x0000000002160000-0x0000000002166000-memory.dmp

Filesize
24KB

Download
memory/712-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/712-8-0x0000000002160000-0x0000000002166000-memory.dmp

Filesize
24KB

Download
memory/804-25-0x00000000020E0000-0x00000000020E6000-memory.dmp

Filesize
24KB

Download