2e7dbd7dedf740e6c56433556a8020ba6240ea083a1b4bee13d90be2f520d683

Analysis

max time kernel
129s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 04:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-02_0cdcea499cbc4213d03d417c9b7c3b63_cryptolocker.exe
Size

32KB
MD5

0cdcea499cbc4213d03d417c9b7c3b63
SHA1

b93f68693724f41a1fbef06fa3dceefa933eb2ac
SHA256

2e7dbd7dedf740e6c56433556a8020ba6240ea083a1b4bee13d90be2f520d683
SHA512

5e7256059c283fa8f33f819aabcd5b39acb25f200d6af7e5a68a77131201e6232a5b2da9036d43a372605f5931bf0de302029310ae4d97ab9823bc02e9d69210
SSDEEP

384:bAvMaNGh4z7CG3POOvbRSLoF/F0QU5XYFnufc/zzo6cJ3v7y:bAvJCYOOvbRPDEgXRcJu

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000a0000000233ea-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	2024-06-02_0cdcea499cbc4213d03d417c9b7c3b63_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	demka.exe

Executes dropped EXE 1 IoCs

pid	Process
4688	demka.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 216 wrote to memory of 4688	216	2024-06-02_0cdcea499cbc4213d03d417c9b7c3b63_cryptolocker.exe	83
PID 216 wrote to memory of 4688	216	2024-06-02_0cdcea499cbc4213d03d417c9b7c3b63_cryptolocker.exe	83
PID 216 wrote to memory of 4688	216	2024-06-02_0cdcea499cbc4213d03d417c9b7c3b63_cryptolocker.exe	83

C:\Users\Admin\AppData\Local\Temp\2024-06-02_0cdcea499cbc4213d03d417c9b7c3b63_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-02_0cdcea499cbc4213d03d417c9b7c3b63_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:216
- C:\Users\Admin\AppData\Local\Temp\demka.exe
  "C:\Users\Admin\AppData\Local\Temp\demka.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\demka.exe

Filesize
32KB

MD5
979897bf147fe142e80c902798b6be25

SHA1
ba00ffe8847eea6367541283666d719d09982a98

SHA256
5f386a4c41613cc941e4debe49f86e5799a326096a4f2fd2db49f0d61de37f82

SHA512
868d87d394e703f0162e3eef6d3e6775403e824bf82ef985489cbc8145514f252a0c799c897174054e11cb7370a305f81834a30db7ecc43fa407bf1fc3abbff6

Download Submit
C:\Users\Admin\AppData\Local\Temp\medkem.exe

Filesize
186B

MD5
ccde01689041ab3e60b8de0fb80057bb

SHA1
a281294613466661d08de19126c4ab9c49fc5ba8

SHA256
a1b51ac6421650119a77155bfb9a2ae2582310054332f67ab7fe27088900e39d

SHA512
76d9ca84d1de2efaad266b6aa13634ed15da5dedfcd53d5cb6b91b7e64af50cfa6e769199036f20df22e52261903ba71a1f5b6ce0720f643bbdbabf60bdeae52

Download Submit
memory/216-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/216-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/216-8-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/4688-25-0x0000000000630000-0x0000000000636000-memory.dmp

Filesize
24KB

Download