Analysis Overview
SHA256
a9541ca5089ba011bd11e09dc183ae2cf143d5684418144ea98f606175dc2ee5
Threat Level: Shows suspicious behavior
The file 2024-11-10_1ca6b0217bd5b3e92e63ae67806d4754_cryptolocker was found to be: Shows suspicious behavior.
Malicious Activity Summary
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Unsigned PE
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of WriteProcessMemory
Suspicious use of UnmapMainImage
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-10 01:27
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-10 01:27
Reported
2024-11-10 01:29
Platform
win7-20240903-en
Max time kernel
132s
Max time network
140s
Command Line
Signatures
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\demka.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\2024-11-10_1ca6b0217bd5b3e92e63ae67806d4754_cryptolocker.exe | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\2024-11-10_1ca6b0217bd5b3e92e63ae67806d4754_cryptolocker.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\demka.exe | N/A |
Suspicious use of UnmapMainImage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\2024-11-10_1ca6b0217bd5b3e92e63ae67806d4754_cryptolocker.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\demka.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2532 wrote to memory of 2524 | N/A | C:\Users\Admin\AppData\Local\Temp\2024-11-10_1ca6b0217bd5b3e92e63ae67806d4754_cryptolocker.exe | C:\Users\Admin\AppData\Local\Temp\demka.exe |
| PID 2532 wrote to memory of 2524 | N/A | C:\Users\Admin\AppData\Local\Temp\2024-11-10_1ca6b0217bd5b3e92e63ae67806d4754_cryptolocker.exe | C:\Users\Admin\AppData\Local\Temp\demka.exe |
| PID 2532 wrote to memory of 2524 | N/A | C:\Users\Admin\AppData\Local\Temp\2024-11-10_1ca6b0217bd5b3e92e63ae67806d4754_cryptolocker.exe | C:\Users\Admin\AppData\Local\Temp\demka.exe |
| PID 2532 wrote to memory of 2524 | N/A | C:\Users\Admin\AppData\Local\Temp\2024-11-10_1ca6b0217bd5b3e92e63ae67806d4754_cryptolocker.exe | C:\Users\Admin\AppData\Local\Temp\demka.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\2024-11-10_1ca6b0217bd5b3e92e63ae67806d4754_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-10_1ca6b0217bd5b3e92e63ae67806d4754_cryptolocker.exe"
C:\Users\Admin\AppData\Local\Temp\demka.exe
"C:\Users\Admin\AppData\Local\Temp\demka.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | ttms.org | udp |
| US | 35.215.114.222:443 | ttms.org | tcp |
| US | 35.215.114.222:443 | ttms.org | tcp |
| US | 35.215.114.222:443 | ttms.org | tcp |
| US | 35.215.114.222:443 | ttms.org | tcp |
| US | 35.215.114.222:443 | ttms.org | tcp |
| US | 35.215.114.222:443 | ttms.org | tcp |
| US | 35.215.114.222:443 | ttms.org | tcp |
Files
memory/2532-0-0x0000000000380000-0x0000000000386000-memory.dmp
memory/2532-1-0x0000000000400000-0x0000000000406000-memory.dmp
memory/2532-7-0x0000000000380000-0x0000000000386000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\demka.exe
| MD5 | b91c52a63079c5f23260d9f21d272a2c |
| SHA1 | 28b00b951571a9b2073dab9640a5131c797f71b0 |
| SHA256 | 36529711ad9116655b89999d1e60dd91cd9b1a204e23c845fb8fc43db025bd12 |
| SHA512 | dbcf75e5e6dd12d3c938545a3db85d1c2c9b0f847f9a2c4f2847893c1aaec00bc16e0fd89c05ae5a8a10b0b3b4843648cc6364f8d50f0160478b3e5fc9f1e54e |
memory/2524-23-0x00000000003F0000-0x00000000003F6000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-10 01:27
Reported
2024-11-10 01:29
Platform
win10v2004-20241007-en
Max time kernel
148s
Max time network
150s
Command Line
Signatures
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\2024-11-10_1ca6b0217bd5b3e92e63ae67806d4754_cryptolocker.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\demka.exe | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\2024-11-10_1ca6b0217bd5b3e92e63ae67806d4754_cryptolocker.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\demka.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 836 wrote to memory of 4300 | N/A | C:\Users\Admin\AppData\Local\Temp\2024-11-10_1ca6b0217bd5b3e92e63ae67806d4754_cryptolocker.exe | C:\Users\Admin\AppData\Local\Temp\demka.exe |
| PID 836 wrote to memory of 4300 | N/A | C:\Users\Admin\AppData\Local\Temp\2024-11-10_1ca6b0217bd5b3e92e63ae67806d4754_cryptolocker.exe | C:\Users\Admin\AppData\Local\Temp\demka.exe |
| PID 836 wrote to memory of 4300 | N/A | C:\Users\Admin\AppData\Local\Temp\2024-11-10_1ca6b0217bd5b3e92e63ae67806d4754_cryptolocker.exe | C:\Users\Admin\AppData\Local\Temp\demka.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\2024-11-10_1ca6b0217bd5b3e92e63ae67806d4754_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-10_1ca6b0217bd5b3e92e63ae67806d4754_cryptolocker.exe"
C:\Users\Admin\AppData\Local\Temp\demka.exe
"C:\Users\Admin\AppData\Local\Temp\demka.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | ttms.org | udp |
| US | 35.215.114.222:443 | ttms.org | tcp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 35.215.114.222:443 | ttms.org | tcp |
| US | 8.8.8.8:53 | 197.87.175.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 35.215.114.222:443 | ttms.org | tcp |
| US | 35.215.114.222:443 | ttms.org | tcp |
| US | 35.215.114.222:443 | ttms.org | tcp |
| US | 35.215.114.222:443 | ttms.org | tcp |
| US | 35.215.114.222:443 | ttms.org | tcp |
| US | 35.215.114.222:443 | ttms.org | tcp |
Files
memory/836-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp
memory/836-1-0x0000000002EA0000-0x0000000002EA6000-memory.dmp
memory/836-2-0x0000000000400000-0x0000000000406000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\demka.exe
| MD5 | b91c52a63079c5f23260d9f21d272a2c |
| SHA1 | 28b00b951571a9b2073dab9640a5131c797f71b0 |
| SHA256 | 36529711ad9116655b89999d1e60dd91cd9b1a204e23c845fb8fc43db025bd12 |
| SHA512 | dbcf75e5e6dd12d3c938545a3db85d1c2c9b0f847f9a2c4f2847893c1aaec00bc16e0fd89c05ae5a8a10b0b3b4843648cc6364f8d50f0160478b3e5fc9f1e54e |
memory/4300-25-0x0000000001FA0000-0x0000000001FA6000-memory.dmp