8c83af43d755c11ea29c8cc71942ef68d02e5ba2c7025b4b9d2089941024ebe3

Analysis

max time kernel
129s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 00:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-28_5154d245b55544b3d37ed45817edb3e8_cryptolocker.exe
Size

38KB
MD5

5154d245b55544b3d37ed45817edb3e8
SHA1

6243d3421b9a9207ab193453a6a48537376ee841
SHA256

8c83af43d755c11ea29c8cc71942ef68d02e5ba2c7025b4b9d2089941024ebe3
SHA512

6f74db16f2dc85285ce0ba1652e6803a6c9c07e20af5996322622c683dac640bb29a17cc6c77eaf7a5fde396e1f9fbbdc005a05bd62d39ee7ec3cdd1d577aca0
SSDEEP

768:bAvJCYOOvbRPDEgXrNekd7l94i3pQheDh8T:bAvJCF+RQgJeab4sbG

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x00090000000233f8-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	2024-05-28_5154d245b55544b3d37ed45817edb3e8_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	demka.exe

Executes dropped EXE 1 IoCs

pid	Process
4644	demka.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 4644	4736	2024-05-28_5154d245b55544b3d37ed45817edb3e8_cryptolocker.exe	83
PID 4736 wrote to memory of 4644	4736	2024-05-28_5154d245b55544b3d37ed45817edb3e8_cryptolocker.exe	83
PID 4736 wrote to memory of 4644	4736	2024-05-28_5154d245b55544b3d37ed45817edb3e8_cryptolocker.exe	83

C:\Users\Admin\AppData\Local\Temp\2024-05-28_5154d245b55544b3d37ed45817edb3e8_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-28_5154d245b55544b3d37ed45817edb3e8_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Users\Admin\AppData\Local\Temp\demka.exe
  "C:\Users\Admin\AppData\Local\Temp\demka.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\demka.exe

Filesize
38KB

MD5
3a4b969b7f021dc10acaaa9d68b7e207

SHA1
5605b16ec7e4226dc09768407880f6e02097c572

SHA256
2a75c2baefda9a038656ccb580b93cbffa83bc8b9d97786b149bd04635865a9e

SHA512
1ababd57be07c2f1edade600fa5bfe09f01031b33f58de10be988c8aedf89a026e0924d3726664bb6a2fd161c6e7696be202e8c8213e0dd13a972b40d1f9219a

Download Submit
C:\Users\Admin\AppData\Local\Temp\medkem.exe

Filesize
186B

MD5
21e853e6a8dc31c0bfc676111a7708a5

SHA1
b53ef8ee2d49f9b05d3f4a5257f2095d764c2715

SHA256
188452a2ac8c44a1f6fc933deb1d7893e9608972d5b93a05eaf0c4c89d77df0d

SHA512
3c9de175e3d2c416996fe0085f93eac701b0047080bd67679079c8a8de1a8603c54a8029d24719dfac50f03111668fd85e2192d700135f55290640d91ed91096

Download Submit
memory/4644-25-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/4736-0-0x0000000000710000-0x0000000000716000-memory.dmp

Filesize
24KB

Download
memory/4736-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4736-8-0x0000000000710000-0x0000000000716000-memory.dmp

Filesize
24KB

Download