0316e6ca691f026d988941aca44fe17700ae4c389b5a392f118668526a61ff4b

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 22:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-01_34f67ed1fa7dc1b5e8b935efb3023eb9_cryptolocker.exe
Size

32KB
MD5

34f67ed1fa7dc1b5e8b935efb3023eb9
SHA1

d2a1ac5734736f8df037045afa8372f64ea29446
SHA256

0316e6ca691f026d988941aca44fe17700ae4c389b5a392f118668526a61ff4b
SHA512

963c41046373d0ea06da431585c3e178a729e1b17d9e57642aa18d1594fb8b11acb7d6d9bce535d8d4266ed90127232b6df8c81b971fa28e17b2d1c976446267
SSDEEP

384:bAvMaNGh4z7CG3POOvbRSLoF/F0QU5XYFnufc/zzo6cJ3vdo9:bAvJCYOOvbRPDEgXRcJQ

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	2024-10-01_34f67ed1fa7dc1b5e8b935efb3023eb9_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3196	demka.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-01_34f67ed1fa7dc1b5e8b935efb3023eb9_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	demka.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 3196	3028	2024-10-01_34f67ed1fa7dc1b5e8b935efb3023eb9_cryptolocker.exe	82
PID 3028 wrote to memory of 3196	3028	2024-10-01_34f67ed1fa7dc1b5e8b935efb3023eb9_cryptolocker.exe	82
PID 3028 wrote to memory of 3196	3028	2024-10-01_34f67ed1fa7dc1b5e8b935efb3023eb9_cryptolocker.exe	82

C:\Users\Admin\AppData\Local\Temp\2024-10-01_34f67ed1fa7dc1b5e8b935efb3023eb9_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-01_34f67ed1fa7dc1b5e8b935efb3023eb9_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Users\Admin\AppData\Local\Temp\demka.exe
  "C:\Users\Admin\AppData\Local\Temp\demka.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\demka.exe

Filesize
32KB

MD5
ff9d8dcc93d79ac52f579ce0d7da6990

SHA1
c40333c0c90475fe3f9002b124e23710b2a4481a

SHA256
a88a7bb79abc788dfb95ada252eb97f809772730b52949011e54b216ab45fc63

SHA512
3660dc00a74543f893fb7623e37a7d8334d06ed200d83c489b1c3b0d41a3f5bae7cb96db6128f51583d6d92a2c8d029bcd8e93b0ea848b7c95fe229e6720c276

Download Submit
memory/3028-0-0x0000000000740000-0x0000000000746000-memory.dmp

Filesize
24KB

Download
memory/3028-1-0x0000000000740000-0x0000000000746000-memory.dmp

Filesize
24KB

Download
memory/3028-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3196-25-0x0000000002090000-0x0000000002096000-memory.dmp

Filesize
24KB

Download