64d92a64f08c741c4b4e895badc925600d6e75b9bf4ba89bb6cfc72608f95806

Analysis

max time kernel
130s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 06:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-09-07_0c7bf35fc39d9bcdf1462fad08fdb72a_cryptolocker.exe
Size

32KB
MD5

0c7bf35fc39d9bcdf1462fad08fdb72a
SHA1

82bd68d2d325993c2ed52f7b14966817233586a2
SHA256

64d92a64f08c741c4b4e895badc925600d6e75b9bf4ba89bb6cfc72608f95806
SHA512

16b6990a6d22f2395d4731e17ac84a4612fc9e521416eee143b03bec1c55bcbd4229ce5cf98658486a1c3e93f549c895741466376159daf74ea1a6750e5c2a5c
SSDEEP

384:bAvMaNGh4z7CG3POOvbRSLoF/F0QU5XYFnufc/zzo6cJ3vdoa:bAvJCYOOvbRPDEgXRcJz

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	2024-09-07_0c7bf35fc39d9bcdf1462fad08fdb72a_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	demka.exe

Executes dropped EXE 1 IoCs

pid	Process
4356	demka.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-07_0c7bf35fc39d9bcdf1462fad08fdb72a_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	demka.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 4356	1448	2024-09-07_0c7bf35fc39d9bcdf1462fad08fdb72a_cryptolocker.exe	84
PID 1448 wrote to memory of 4356	1448	2024-09-07_0c7bf35fc39d9bcdf1462fad08fdb72a_cryptolocker.exe	84
PID 1448 wrote to memory of 4356	1448	2024-09-07_0c7bf35fc39d9bcdf1462fad08fdb72a_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-09-07_0c7bf35fc39d9bcdf1462fad08fdb72a_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-07_0c7bf35fc39d9bcdf1462fad08fdb72a_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Users\Admin\AppData\Local\Temp\demka.exe
  "C:\Users\Admin\AppData\Local\Temp\demka.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\demka.exe

Filesize
33KB

MD5
1c300fb62f9c29a93ffdc6868d2efb39

SHA1
c492bb66233f89b9514d84718521c52bb872d01e

SHA256
5e3a9c03f2684f49e235d37814c09ae86b026620afaae13f22aa9bde1303ba3f

SHA512
a59847c6ea1e17f2c663e4f2e9b9ce0b6086d6d6d2cb6a4fab214285523ae5934cf4cf35d4ffa089fb971d9b8acb3d919a6cdf94ebbc16d86e003caa91b72f10

Download Submit
C:\Users\Admin\AppData\Local\Temp\medkem.exe

Filesize
185B

MD5
3e6bc13dc86bb3c27fc3881a552f34e9

SHA1
58144f40e001ff1b28bdb47aeaf7b70c2340b0de

SHA256
530d34f75e02ee3b5eeb33f423b69c0a72c0382d38bac8f143abc775a4bc4b74

SHA512
894d0b5d329b40b9bed51ba16d00a51a21d46980997cdbf9a8a240381de27e36ca09cf21c9e616b92ce13ca2eee447f0c0fcfab670f09241466d50b92af5c81b

Download Submit
memory/1448-0-0x0000000002210000-0x0000000002216000-memory.dmp

Filesize
24KB

Download
memory/1448-1-0x0000000002210000-0x0000000002216000-memory.dmp

Filesize
24KB

Download
memory/1448-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4356-19-0x00000000006F0000-0x00000000006F6000-memory.dmp

Filesize
24KB

Download