933b3e200552d8a3bebb45fa36a9fdb58b10c78f5b3864bff1a01b1cf33bd338

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2024, 04:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-21_b79808f414c9a24bc077c46a8d89b9f7_cryptolocker.exe
Size

38KB
MD5

b79808f414c9a24bc077c46a8d89b9f7
SHA1

16caee7e19c5937b23cfe26fc426723facf3714d
SHA256

933b3e200552d8a3bebb45fa36a9fdb58b10c78f5b3864bff1a01b1cf33bd338
SHA512

11d6eb214cd5089bfa291e9f73d6c9c986d1f7fb375adac135122e033231ad6865e244effc04f279d35b90bc04d9ddc9fe89cabed266503136c327c103607937
SSDEEP

768:bAvJCYOOvbRPDEgXrNekd7l94i3pQheDZFD:bAvJCF+RQgJeab4sbj

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	2024-11-21_b79808f414c9a24bc077c46a8d89b9f7_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	demka.exe

Executes dropped EXE 1 IoCs

pid	Process
2888	demka.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-21_b79808f414c9a24bc077c46a8d89b9f7_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	demka.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2888	2968	2024-11-21_b79808f414c9a24bc077c46a8d89b9f7_cryptolocker.exe	83
PID 2968 wrote to memory of 2888	2968	2024-11-21_b79808f414c9a24bc077c46a8d89b9f7_cryptolocker.exe	83
PID 2968 wrote to memory of 2888	2968	2024-11-21_b79808f414c9a24bc077c46a8d89b9f7_cryptolocker.exe	83

C:\Users\Admin\AppData\Local\Temp\2024-11-21_b79808f414c9a24bc077c46a8d89b9f7_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-21_b79808f414c9a24bc077c46a8d89b9f7_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Users\Admin\AppData\Local\Temp\demka.exe
  "C:\Users\Admin\AppData\Local\Temp\demka.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\demka.exe

Filesize
39KB

MD5
0a47e60e6d3bd655445a7d451ce635a2

SHA1
9f0538689c91413ed07ad0c0fe1f17ae2bb16bc3

SHA256
12469061d6baac4d8e8f4322206dcd0011fa7e464c000118c9350a8bf6fd31e3

SHA512
3960f742eb8100999b11399303bb38c470f83a7071390303c478287e1dfc47f6f95c5ea505295c57a28b4615c94c649652325901ea84d368e05c2bf63e6fe441

Download Submit
C:\Users\Admin\AppData\Local\Temp\medkem.exe

Filesize
186B

MD5
298acb49d08f9873bda6f03636ea1980

SHA1
00bcba9507e5c30e57cd09c6fbc4ed1aad4cdde8

SHA256
61dc781ccfb1cc3a2528fef06459a05d317b1af821900dfe69d66891f0c9c4a9

SHA512
077c6623eadb4eaf80990f9c2e2a977073338c701a0642561bbb30d4bc0666ba41ecd91c3b1341ac1907ea4abbab24b88de62d5dbb7bd70e9c83e180fd3a5f7d

Download Submit
memory/2888-19-0x0000000002020000-0x0000000002026000-memory.dmp

Filesize
24KB

Download
memory/2968-0-0x0000000002210000-0x0000000002216000-memory.dmp

Filesize
24KB

Download
memory/2968-1-0x0000000002210000-0x0000000002216000-memory.dmp

Filesize
24KB

Download
memory/2968-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download