3e00ed14d3815e9b5c9ca1f9d28381b144b20322b3eb57d10cb63fab15c0a823

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 07:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-31_c89ad1bb9d003663a901631624233e29_cryptolocker.exe
Size

32KB
MD5

c89ad1bb9d003663a901631624233e29
SHA1

a16f6c8477c9fe51658109b0aa55b4eb4dd7d27d
SHA256

3e00ed14d3815e9b5c9ca1f9d28381b144b20322b3eb57d10cb63fab15c0a823
SHA512

ac783b01df5090349ed52a2e2b2181b18e1827131558dbeaefef405b6297c34817396773affc615abad38798dadf32ec57e5892f297602eecba4640eda1f35a5
SSDEEP

384:bAvMaNGh4z7CG3POOvbRSLoF/F0QU5XYFnufc/zzo6cJ3v7j:bAvJCYOOvbRPDEgXRcJ3

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000b00000002321b-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	2024-05-31_c89ad1bb9d003663a901631624233e29_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	demka.exe

Executes dropped EXE 1 IoCs

pid	Process
4828	demka.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 4828	2420	2024-05-31_c89ad1bb9d003663a901631624233e29_cryptolocker.exe	90
PID 2420 wrote to memory of 4828	2420	2024-05-31_c89ad1bb9d003663a901631624233e29_cryptolocker.exe	90
PID 2420 wrote to memory of 4828	2420	2024-05-31_c89ad1bb9d003663a901631624233e29_cryptolocker.exe	90

C:\Users\Admin\AppData\Local\Temp\2024-05-31_c89ad1bb9d003663a901631624233e29_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-31_c89ad1bb9d003663a901631624233e29_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Users\Admin\AppData\Local\Temp\demka.exe
  "C:\Users\Admin\AppData\Local\Temp\demka.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2228 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
1⤵
PID:1860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\demka.exe

Filesize
33KB

MD5
c9dc982e79c1de5cd912f1c512d1a0da

SHA1
dac4ba68d116f4067079fd40d9143244d8fa8b11

SHA256
5b71b5f31178d7cc01b877cc926abbba3679e723b8482e634de2f109b39d4312

SHA512
35d012b82b83b4ad8657694b1c962a192f03eaec31470a066004a72de63b6fc92964a03f3d069edfb329a39bb1f08e80b5a057b1bc69360b8b8ca72e73c17128

Download Submit
C:\Users\Admin\AppData\Local\Temp\medkem.exe

Filesize
186B

MD5
a306db045350df81860877dbc440afcd

SHA1
f1ebc4665e81971d2a4943e2082b62ad6d6b344f

SHA256
da56b4b9b3e85c87f838e4d5d6be426571c7b8c0be9193ccf6ecc2e73ef4eb95

SHA512
97bdcccfc61f1ece15666a9bd00b7b21f5a86e53e11ea842992d29eac0adefba901c9a3dd20ef95c4511ec7636887aaabe2597bec976bcfc6e00e779501866a4

Download Submit
memory/2420-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/2420-1-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/2420-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4828-25-0x0000000002210000-0x0000000002216000-memory.dmp

Filesize
24KB

Download