Analysis
-
max time kernel
130s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 01:22
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-23_040d6bfa90c6d79d38453526b64d89f7_cryptolocker.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-23_040d6bfa90c6d79d38453526b64d89f7_cryptolocker.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-23_040d6bfa90c6d79d38453526b64d89f7_cryptolocker.exe
-
Size
37KB
-
MD5
040d6bfa90c6d79d38453526b64d89f7
-
SHA1
ed803e29850c58b57c57e98f1bd4efa612ca22c6
-
SHA256
7a01584a7e4b420b400ddbb21b7cc6d89b1bd10058c3bc73c813307e2d8d7168
-
SHA512
903819fb07a6d234ce6711793cfaf9211b083e61b0cd171aa72b79278d4f33f500a46559af4bbb468cca8be9ec061a51cff2bd570663f46d58366d58f881d87b
-
SSDEEP
768:bAvJCYOOvbRPDEgXrNekd7l94i3pQheDIr:bAvJCF+RQgJeab4sbW
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\demka.exe CryptoLocker_rule2 -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2024-05-23_040d6bfa90c6d79d38453526b64d89f7_cryptolocker.exedemka.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 2024-05-23_040d6bfa90c6d79d38453526b64d89f7_cryptolocker.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation demka.exe -
Executes dropped EXE 1 IoCs
Processes:
demka.exepid process 392 demka.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
2024-05-23_040d6bfa90c6d79d38453526b64d89f7_cryptolocker.exedescription pid process target process PID 3516 wrote to memory of 392 3516 2024-05-23_040d6bfa90c6d79d38453526b64d89f7_cryptolocker.exe demka.exe PID 3516 wrote to memory of 392 3516 2024-05-23_040d6bfa90c6d79d38453526b64d89f7_cryptolocker.exe demka.exe PID 3516 wrote to memory of 392 3516 2024-05-23_040d6bfa90c6d79d38453526b64d89f7_cryptolocker.exe demka.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_040d6bfa90c6d79d38453526b64d89f7_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_040d6bfa90c6d79d38453526b64d89f7_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\demka.exe"C:\Users\Admin\AppData\Local\Temp\demka.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\demka.exeFilesize
37KB
MD5b7f2917a0ee08b613915c7ade1de9f6c
SHA19fd3ca659a50c4987b83a7a394d231a5b61434cf
SHA2560d19ba7f80f95a49ac47e3caaa5ef6ed832e2b9b5851961f3e3478b33adfe6a2
SHA5126c8fd8ce0984a6242d3467943be818c410c55b5e123df54e98021cfcf6d96b78081369effad61a55eb1de3037ad870a0802fd8626059c72da7b4b7aa880924ec
-
C:\Users\Admin\AppData\Local\Temp\medkem.exeFilesize
186B
MD5d8287aa1c9fcd7fa87ab62094a8f4873
SHA1bea5aefe15f8f5668de1bd3ef16d2e7b947bce95
SHA256d12d433509f895a1732e20f23ae6987940aa434c88ee155a3806e7be699e4343
SHA512f947702a012330d24382d91b72d1a7f013e5e17a84b7ccfcb431e086c41c0e508223655b12388b6559017ca7300fa7289845c2f406c62d3155af54a7cf2563e1
-
memory/392-25-0x0000000002EA0000-0x0000000002EA6000-memory.dmpFilesize
24KB
-
memory/3516-0-0x0000000002060000-0x0000000002066000-memory.dmpFilesize
24KB
-
memory/3516-1-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/3516-8-0x0000000002060000-0x0000000002066000-memory.dmpFilesize
24KB