Analysis

  • max time kernel
    141s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230831-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/09/2023, 11:27

General

  • Target

    2023-08-22_a94c942d4a76c2c3ada89f1b7e8b3a8c_cryptolocker_JC.exe

  • Size

    59KB

  • MD5

    a94c942d4a76c2c3ada89f1b7e8b3a8c

  • SHA1

    c1a82efbbfa6f138ed74a1d5047665a151cfbc95

  • SHA256

    e47b8740904e9583137a0ad4fd922639d24ada1412df70dd1f7a45513be8744b

  • SHA512

    202c18b6f7f2ce84c6fe5a7f7e49a3d117ccd1150225ce10da1312a964472ab11c8df20fc681a1d12c6bf38c314795ff7ef2a59a0190d28c23447477f3ed8944

  • SSDEEP

    1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszudnYTjipvF29B:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7j

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2023-08-22_a94c942d4a76c2c3ada89f1b7e8b3a8c_cryptolocker_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\2023-08-22_a94c942d4a76c2c3ada89f1b7e8b3a8c_cryptolocker_JC.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3888
    • C:\Users\Admin\AppData\Local\Temp\hurok.exe
      "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      PID:4712

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\hurok.exe

    Filesize

    59KB

    MD5

    9cf6bfc61745ff822f8f3ba77fd4178e

    SHA1

    15e83ad6c3977ebdc71425d15042b0b6005f7294

    SHA256

    4d463618a7161d20327772c22b86d6e77fe95fe785bf5b945682ff33e887bffb

    SHA512

    427e5dd1c866785f85b7a32ec821f6495ce7e1c94095fd96ef6d9288e2f27f314338f3cf4348cb53cc16807617d19dc9b6fc2f5aa9bc3edbe91ea9c9f24802e2

  • C:\Users\Admin\AppData\Local\Temp\hurok.exe

    Filesize

    59KB

    MD5

    9cf6bfc61745ff822f8f3ba77fd4178e

    SHA1

    15e83ad6c3977ebdc71425d15042b0b6005f7294

    SHA256

    4d463618a7161d20327772c22b86d6e77fe95fe785bf5b945682ff33e887bffb

    SHA512

    427e5dd1c866785f85b7a32ec821f6495ce7e1c94095fd96ef6d9288e2f27f314338f3cf4348cb53cc16807617d19dc9b6fc2f5aa9bc3edbe91ea9c9f24802e2

  • C:\Users\Admin\AppData\Local\Temp\hurok.exe

    Filesize

    59KB

    MD5

    9cf6bfc61745ff822f8f3ba77fd4178e

    SHA1

    15e83ad6c3977ebdc71425d15042b0b6005f7294

    SHA256

    4d463618a7161d20327772c22b86d6e77fe95fe785bf5b945682ff33e887bffb

    SHA512

    427e5dd1c866785f85b7a32ec821f6495ce7e1c94095fd96ef6d9288e2f27f314338f3cf4348cb53cc16807617d19dc9b6fc2f5aa9bc3edbe91ea9c9f24802e2

  • memory/3888-0-0x0000000002300000-0x0000000002306000-memory.dmp

    Filesize

    24KB

  • memory/3888-1-0x0000000002300000-0x0000000002306000-memory.dmp

    Filesize

    24KB

  • memory/3888-2-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/4712-20-0x00000000005A0000-0x00000000005A6000-memory.dmp

    Filesize

    24KB