Analysis

  • max time kernel
    132s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-06-2024 03:50

General

  • Target

    2024-06-03_a0c947078ef78a2d5fa0e119cb4aec4a_cryptolocker.exe

  • Size

    37KB

  • MD5

    a0c947078ef78a2d5fa0e119cb4aec4a

  • SHA1

    260d3cfa01a5e9ace490451295e2e61d49215a92

  • SHA256

    93c095fe9665df3979ee2f9f460ea5aa343e45a11ef8d55754c3bd3dcad11542

  • SHA512

    bf1c425c6dd761b832fe11bbd9daec07cab7506fa34d9d7e8c29f40acfaf3e85306d2c2a726dcdfbc39b7cd748cdebd8f7bfdd62ae13c641f0c21faa640caf35

  • SSDEEP

    768:bAvJCYOOvbRPDEgXrNekd7l94i3pQheDOk:bAvJCF+RQgJeab4sb9

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-03_a0c947078ef78a2d5fa0e119cb4aec4a_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-03_a0c947078ef78a2d5fa0e119cb4aec4a_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4656
    • C:\Users\Admin\AppData\Local\Temp\demka.exe
      "C:\Users\Admin\AppData\Local\Temp\demka.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      PID:4688

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\demka.exe

    Filesize

    37KB

    MD5

    ca3919e9e24a93bb6d6fbc52ab2245c1

    SHA1

    1e65771c0be3f1b510108e4260a25499241a6242

    SHA256

    52105a45b92afa44b82b7fbe0e0f137e4674b69ab5a12c3416c8e98be0a6cfd3

    SHA512

    2f25f58d8d0597cb0012bb84ea8e45d44e9787afa8d5d5ed4b71c5a3735e07090764a172dea92bc60ca3a8704d8ca9b0a45fb1fde49668a4bee3ccf48712a7fd

  • C:\Users\Admin\AppData\Local\Temp\medkem.exe

    Filesize

    186B

    MD5

    2b71e989eb0a1bbdb8bd269e689939b2

    SHA1

    64eafab9a6da63314369df6b499d318d939f53e1

    SHA256

    dc15b236e84b9e2d978358b2e8499585f50166f9bda77b68aed5b8fa2c6c61a7

    SHA512

    77366cf754c191fe46bf237d9a47e3210b1971ad4b3f392301c3c2657c9420a47c8eb4336054768f9fbe82510c01209c60f6d30c342e3c34f64de1f83adc851a

  • memory/4656-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

    Filesize

    24KB

  • memory/4656-1-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/4656-8-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

    Filesize

    24KB