da48c94e41795ba3dd40003221baca973f90a4d43485488fbd92dfa2443c55ec

Analysis

max time kernel
135s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 05:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-25_94afb492b2afd14e1dd4c00bace78b5e_cryptolocker.exe
Size

32KB
MD5

94afb492b2afd14e1dd4c00bace78b5e
SHA1

94fae295568f930c41c89a5c5bfdf44621b7b33f
SHA256

da48c94e41795ba3dd40003221baca973f90a4d43485488fbd92dfa2443c55ec
SHA512

19957de86be5a508e70b1a5c4e6ffdffb6c7280a10459fba72a2e696222953625c98f4fa952cfe409616277e3903241e368a6eb87feb4bb8b730021dd1abb8f0
SSDEEP

384:bAvMaNGh4z7CG3POOvbRSLoF/F0QU5XYFnufc/zzo6cJ3v7/b:bAvJCYOOvbRPDEgXRcJX

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\demka.exe	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-05-25_94afb492b2afd14e1dd4c00bace78b5e_cryptolocker.exedemka.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	2024-05-25_94afb492b2afd14e1dd4c00bace78b5e_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	demka.exe

Executes dropped EXE 1 IoCs

Processes:

demka.exe

pid process

3976 demka.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3976	demka.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-25_94afb492b2afd14e1dd4c00bace78b5e_cryptolocker.exe

description	pid	process	target process
PID 3720 wrote to memory of 3976	3720	2024-05-25_94afb492b2afd14e1dd4c00bace78b5e_cryptolocker.exe	demka.exe
PID 3720 wrote to memory of 3976	3720	2024-05-25_94afb492b2afd14e1dd4c00bace78b5e_cryptolocker.exe	demka.exe
PID 3720 wrote to memory of 3976	3720	2024-05-25_94afb492b2afd14e1dd4c00bace78b5e_cryptolocker.exe	demka.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-25_94afb492b2afd14e1dd4c00bace78b5e_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-25_94afb492b2afd14e1dd4c00bace78b5e_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Users\Admin\AppData\Local\Temp\demka.exe
  "C:\Users\Admin\AppData\Local\Temp\demka.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4276,i,2607710392823067546,4648797561512801463,262144 --variations-seed-version --mojo-platform-channel-handle=4056 /prefetch:8
1⤵
PID:4632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\demka.exe

Filesize
32KB

MD5
3d68e572539519901364caa2be7542fc

SHA1
f3639322433c1ad88cd069cadfb616674b7c57ec

SHA256
6dcfd485f24c6dcdbfac283a2978057036c8dc735c01d0fe3ca6cbf091fe69a4

SHA512
eb94373536ad295ec64ae09e0b045647afc435fd1c667a34db2d138653e59f1391942cea8714f51deb4dd07b1f0347451a60bf5a2825ac2cb091bb5f77694a1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\medkem.exe

Filesize
186B

MD5
e801eb7b3684cae290beee1f81825d06

SHA1
04d827de8785d06565fd56e4f90d0ee6f090fec8

SHA256
847e679cb980617503b89f2d65f4492775f54337b0ae2853ea6f1ab683248969

SHA512
9851f74c6269c290f1ea560a7907746dfe38e24137afaf9ea490294ac84ac5b53e489b8ae45b6403a10f24c72aa81ef0d6cf00c0c93ef139a2f7655a63c416e9

Download Submit
memory/3720-0-0x0000000002150000-0x0000000002156000-memory.dmp

Filesize
24KB

Download
memory/3720-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3720-8-0x0000000002150000-0x0000000002156000-memory.dmp

Filesize
24KB

Download
memory/3976-25-0x0000000002090000-0x0000000002096000-memory.dmp

Filesize
24KB

Download