e480485a43619c439234b5d1c1e1176d11869444601a6f07aa2ec77eda353e73

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 20:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-21_5dd24a8dd1cd321eb1cafc8682a2abe2_cryptolocker.exe
Size

34KB
MD5

5dd24a8dd1cd321eb1cafc8682a2abe2
SHA1

141347d7730e32463fce1c4b2c7ab99298ade4b9
SHA256

e480485a43619c439234b5d1c1e1176d11869444601a6f07aa2ec77eda353e73
SHA512

07553cc4e251c392d5545ea783c3ded2f0327cfbde372023d60543f4b374ff37b05bf4b178e70f8a901a5fbfe064009dfce10f36bf24950c468c21ad738626e5
SSDEEP

384:bAvMaNGh4z7CG3POOvbRSLoF/F0QU5XYFnufc/zzo6ckJp0qAgmEzXKxA+T9xlb:bAvJCYOOvbRPDEgXRc+BAILihb

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\demka.exe	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-05-21_5dd24a8dd1cd321eb1cafc8682a2abe2_cryptolocker.exedemka.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	2024-05-21_5dd24a8dd1cd321eb1cafc8682a2abe2_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	demka.exe

Executes dropped EXE 1 IoCs

Processes:

demka.exe

pid process

1140 demka.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1140	demka.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-21_5dd24a8dd1cd321eb1cafc8682a2abe2_cryptolocker.exe

description	pid	process	target process
PID 2664 wrote to memory of 1140	2664	2024-05-21_5dd24a8dd1cd321eb1cafc8682a2abe2_cryptolocker.exe	demka.exe
PID 2664 wrote to memory of 1140	2664	2024-05-21_5dd24a8dd1cd321eb1cafc8682a2abe2_cryptolocker.exe	demka.exe
PID 2664 wrote to memory of 1140	2664	2024-05-21_5dd24a8dd1cd321eb1cafc8682a2abe2_cryptolocker.exe	demka.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-21_5dd24a8dd1cd321eb1cafc8682a2abe2_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-21_5dd24a8dd1cd321eb1cafc8682a2abe2_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2664

C:\Users\Admin\AppData\Local\Temp\demka.exe
"C:\Users\Admin\AppData\Local\Temp\demka.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:1140

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\demka.exe
Filesize
35KB

MD5
e326ad4b76e243dfebcb9b0db91f223c

SHA1
7ae4d48656234efd497f014c58f06199592da7f1

SHA256
c113acbc41eb566f6c98216050c7d94f6644977ff28ac0d41dda9a192a32de85

SHA512
eec5edae2dfebe62945198868329f76a3ac83f2ee4a77c60d73f4c98b2588e6bfcdd1fa1be394fd3f2eee3576a6d47122e870c2431ababa23514d414d8bb222b

Download Submit
C:\Users\Admin\AppData\Local\Temp\medkem.exe
Filesize
186B

MD5
aa863e9a38f5ba79cc8631220a51753b

SHA1
d706854120247a61099e949b0c793ef83e74f8dc

SHA256
65e63c170b855d4469b897cc45310b29f47d10991eb30be7f182bff3440cdb14

SHA512
bd2bd94dc85c0f2980a44440fa684b1ebaefa0d9eeb6b304b418346f4c7a51543bfeffff73048116a8e64495f8a9a4e34826a60a69aeb1ed258fa73007d4a47e

Download Submit
memory/2664-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/2664-8-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/2664-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download