8a813171f49445e19cf3d2a4ddee94676c24feb2fb60c7c86fc51ceb92c247fe

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-05-14_e545f39d3f0cfdb248182757c403230b_cryptolocker.exe
Size

32KB
MD5

e545f39d3f0cfdb248182757c403230b
SHA1

a98a38f3c3a15bc9d93bac7aff512ea22c23671c
SHA256

8a813171f49445e19cf3d2a4ddee94676c24feb2fb60c7c86fc51ceb92c247fe
SHA512

3d4b9e0628c2de0beda0175d6cec536599d6001306a6132b118e9af2c1cc7aaec07d2bf0036cf132a7ae47835048495a3f169521520a77ea794431c28f69d3d8
SSDEEP

384:bAvMaNGh4z7CG3POOvbRSLoF/F0QU5XYFnufc/zzo6cJ3v7W:bAvJCYOOvbRPDEgXRcJK

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x00050000000232a4-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	2024-05-14_e545f39d3f0cfdb248182757c403230b_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	demka.exe

Executes dropped EXE 1 IoCs

pid	Process
4660	demka.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3788 wrote to memory of 4660	3788	2024-05-14_e545f39d3f0cfdb248182757c403230b_cryptolocker.exe	82
PID 3788 wrote to memory of 4660	3788	2024-05-14_e545f39d3f0cfdb248182757c403230b_cryptolocker.exe	82
PID 3788 wrote to memory of 4660	3788	2024-05-14_e545f39d3f0cfdb248182757c403230b_cryptolocker.exe	82

C:\Users\Admin\AppData\Local\Temp\2024-05-14_e545f39d3f0cfdb248182757c403230b_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-14_e545f39d3f0cfdb248182757c403230b_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3788
- C:\Users\Admin\AppData\Local\Temp\demka.exe
  "C:\Users\Admin\AppData\Local\Temp\demka.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\demka.exe

Filesize
32KB

MD5
b747c9a99310417af1fe1b70937858ad

SHA1
33179c8ae9da5b289bd2ab9d334480c36cd3b8c3

SHA256
96c4e52a56a436641a96af702db59de71d269c26f88521f0d2038a667b3f7333

SHA512
04644b30ac4cfc406327303c5a3240bc2707891b647404e5c71346a2a9817dbf9bd8b1bef5b9f716b56c32b5095b58571731aca446bb0cc5a1e6dbc3cfff3ef7

Download Submit
C:\Users\Admin\AppData\Local\Temp\medkem.exe

Filesize
186B

MD5
2618ae36c79fed85efa84406347b19fe

SHA1
dc8ed1b959ccaa7ea99fffde60b949dadd2afd6e

SHA256
291d3a5e23e397c04679b9738bf09c120b2ed80c4f19b750b58338b86f97dfb2

SHA512
2ea395d3c10fa13fac3e3b2431f15c02b1d6dc5aebc43ba88ce98fb658c1ab9d7aabd98136a952b0fbfb341d821a7804c5cdc4fbec04444e83b598f929d304f5

Download Submit
memory/3788-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/3788-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3788-8-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/4660-25-0x0000000002D60000-0x0000000002D66000-memory.dmp

Filesize
24KB

Download