f1c1c50554df671149df76cc43d022577649d5db4f2a131b84c6c76915b9e76f

Analysis

max time kernel
152s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 06:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-11_e9cc26cc4866cfb2c1387df28b47e0d7_cryptolocker.exe
Size

60KB
MD5

e9cc26cc4866cfb2c1387df28b47e0d7
SHA1

7548042071dd7587b3914d6a344ffc3bf41684f7
SHA256

f1c1c50554df671149df76cc43d022577649d5db4f2a131b84c6c76915b9e76f
SHA512

b480a4265e7d9a37621ef554da2dd607ba32a2793e609808e55b66fc0232627b68ff66921ae7bd374c03bfc3f9fd18414c88b8552aa608b7853b9fcad37b1daa
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszsbKY1x/9lfL+gniDSAk:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7g

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	hurok.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	2024-01-11_e9cc26cc4866cfb2c1387df28b47e0d7_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2232	hurok.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 2232	4892	2024-01-11_e9cc26cc4866cfb2c1387df28b47e0d7_cryptolocker.exe	95
PID 4892 wrote to memory of 2232	4892	2024-01-11_e9cc26cc4866cfb2c1387df28b47e0d7_cryptolocker.exe	95
PID 4892 wrote to memory of 2232	4892	2024-01-11_e9cc26cc4866cfb2c1387df28b47e0d7_cryptolocker.exe	95

C:\Users\Admin\AppData\Local\Temp\2024-01-11_e9cc26cc4866cfb2c1387df28b47e0d7_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-11_e9cc26cc4866cfb2c1387df28b47e0d7_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
60KB

MD5
da06265224ebbf034df9e3fc513574f8

SHA1
6b95ee3dae204af69b6e59e26542b7213965b032

SHA256
98a6bc15e68da59822bed5c7878aa231a552dbf1a3bbfe15e22f3680080aeedd

SHA512
b8ae76d7453ec32330831145ad82389170940aead207e4752c409ab5a04894427e867af65dd066f27e088cca61a693b6ab3a622a26b9939de0efb33ea055b472

Download Submit
memory/2232-28-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/4892-0-0x0000000002280000-0x0000000002286000-memory.dmp

Filesize
24KB

Download
memory/4892-1-0x0000000002280000-0x0000000002286000-memory.dmp

Filesize
24KB

Download
memory/4892-3-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download