4e4ef953b205e7e65dd195f4f27b220d8e0946e7459f3c8e0a8198ec216b558a

Analysis

max time kernel
141s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20-05-2024 18:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-20_b2168f93f73cad852b6e5ded62fa7d14_cryptolocker.exe
Size

32KB
MD5

b2168f93f73cad852b6e5ded62fa7d14
SHA1

fc13237f2b4607d9d9f90587763fc0bd0c922074
SHA256

4e4ef953b205e7e65dd195f4f27b220d8e0946e7459f3c8e0a8198ec216b558a
SHA512

37883b1cef7922ba496e2a80875caf1b88f68eda26cd41a9f89c765a2b6049fb6e596210f1f323411b1c9bc76a435a0688f947598e813d65f946ee37da3aaf27
SSDEEP

384:bAvMaNGh4z7CG3POOvbRSLoF/F0QU5XYFnufc/zzo6cJ3v7sA:bAvJCYOOvbRPDEgXRcJwA

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000e000000023240-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	2024-05-20_b2168f93f73cad852b6e5ded62fa7d14_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	demka.exe

Executes dropped EXE 1 IoCs

pid	Process
1396	demka.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 1396	3076	2024-05-20_b2168f93f73cad852b6e5ded62fa7d14_cryptolocker.exe	91
PID 3076 wrote to memory of 1396	3076	2024-05-20_b2168f93f73cad852b6e5ded62fa7d14_cryptolocker.exe	91
PID 3076 wrote to memory of 1396	3076	2024-05-20_b2168f93f73cad852b6e5ded62fa7d14_cryptolocker.exe	91

C:\Users\Admin\AppData\Local\Temp\2024-05-20_b2168f93f73cad852b6e5ded62fa7d14_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-20_b2168f93f73cad852b6e5ded62fa7d14_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Users\Admin\AppData\Local\Temp\demka.exe
  "C:\Users\Admin\AppData\Local\Temp\demka.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:1396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4440 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\demka.exe

Filesize
32KB

MD5
7b2e85e9d3dc3eb0d57a6015c4cd5cb1

SHA1
d2a6809e3adf9d3e52835b29fc6c37e9ff51d265

SHA256
20071a465b593200ccbf74f1dc9a230a7d3b3e31b5b4a522e5a0959b01572b71

SHA512
70462a7bdeaa37871fb10b7b34c5ffa255019bea4071439b356ff0ff0a273ce6feb8defea6e81ddbc1728851335be077d937b88faf16d94af2e35c2a5641cc3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\medkem.exe

Filesize
186B

MD5
84fe988e8caee89f1dd9eb606409fc1a

SHA1
98d7791c11063b3a1548b145e064d9a0f9b01b51

SHA256
c34cdf38574ffb0d0edd6afb0ed471ea1831e61c82620388fb426e0b81ff57e2

SHA512
e3951c1e507ee085613c0b869ab0b0657a894d55172fd1d7fec1922080ea878ab30add89d1522660502e2de55bb9eb1a41d76a5e45916ed5fc5990b932f13ac0

Download Submit
memory/1396-25-0x0000000002110000-0x0000000002116000-memory.dmp

Filesize
24KB

Download
memory/3076-0-0x00000000021D0000-0x00000000021D6000-memory.dmp

Filesize
24KB

Download
memory/3076-1-0x00000000021D0000-0x00000000021D6000-memory.dmp

Filesize
24KB

Download
memory/3076-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download