f238b30d3dd263b4d70c39c1faf280698e0347aecea74260d063ef0968a48a41

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 06:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-31_d72b364090898b419c4c970cffd6244f_cryptolocker.exe
Size

32KB
MD5

d72b364090898b419c4c970cffd6244f
SHA1

deb09e1588fc6cc8d8734afc9e0148a21b196e32
SHA256

f238b30d3dd263b4d70c39c1faf280698e0347aecea74260d063ef0968a48a41
SHA512

213ae2729f0070ad73c3795403c2917a3a98ff0d335c10b5830f394058257f6fcb92fe18dfb8505ded23db8c4ed7b472dfef22a02ec6232483a9bee903626634
SSDEEP

384:bAvMaNGh4z7CG3POOvbRSLoF/F0QU5XYFnufc/zzo6cJ3v7V:bAvJCYOOvbRPDEgXRcJh

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000600000002326e-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	2024-05-31_d72b364090898b419c4c970cffd6244f_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	demka.exe

Executes dropped EXE 1 IoCs

pid	Process
1112	demka.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 1112	2492	2024-05-31_d72b364090898b419c4c970cffd6244f_cryptolocker.exe	82
PID 2492 wrote to memory of 1112	2492	2024-05-31_d72b364090898b419c4c970cffd6244f_cryptolocker.exe	82
PID 2492 wrote to memory of 1112	2492	2024-05-31_d72b364090898b419c4c970cffd6244f_cryptolocker.exe	82

C:\Users\Admin\AppData\Local\Temp\2024-05-31_d72b364090898b419c4c970cffd6244f_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-31_d72b364090898b419c4c970cffd6244f_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Users\Admin\AppData\Local\Temp\demka.exe
  "C:\Users\Admin\AppData\Local\Temp\demka.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:1112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\demka.exe

Filesize
33KB

MD5
3909b475076437428fd281f9c305e93b

SHA1
821eec42cc979a15eb618edf2b7d14fe22847b2c

SHA256
11ca9f1c21c15e5bf92781d8eea4aa3ad6ce505a782004150d2c40553f17de18

SHA512
21d4af9ec9021d77428f8ec24c1664cccfc2e3334e124edb634c9e5f152973a3feb8a9f23a2824ff7fe893178e18eb9d73fd2996bd2856a132aa707075c08198

Download Submit
C:\Users\Admin\AppData\Local\Temp\medkem.exe

Filesize
186B

MD5
a816eba3135f1bd2fc8bf1379baab374

SHA1
0a4161b85d340c480e2298b23d5565fb8c5e0b6d

SHA256
c08b91b65e2d2d0e249a93e904e622bd6dbc785c8745cdea64f2798f969741b7

SHA512
b8f2593c7d37e49dd6668df8821e35915eb9c89e5ebab52ceb712ca9342e262b917cb430bd923e6a3b4d349991c1a87ba4e78ffd2598453fba213fe1c9495b71

Download Submit
memory/1112-25-0x0000000001FF0000-0x0000000001FF6000-memory.dmp

Filesize
24KB

Download
memory/2492-0-0x0000000002160000-0x0000000002166000-memory.dmp

Filesize
24KB

Download
memory/2492-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2492-8-0x0000000002160000-0x0000000002166000-memory.dmp

Filesize
24KB

Download