51fba9bcf3977b1d408154b6c8deb016222bb604ab39f08f37aac56812a85a21

Analysis

max time kernel
88s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2024 17:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-12_80041a25539fcbaa8dfe99b3ecc05889_cryptolocker.exe
Size

49KB
MD5

80041a25539fcbaa8dfe99b3ecc05889
SHA1

7581916b7dffe84b187252bf96c36b75de10717a
SHA256

51fba9bcf3977b1d408154b6c8deb016222bb604ab39f08f37aac56812a85a21
SHA512

d9000110dcc947f04e9e6ed3d1d070b37782fa86a1a889a84ef3531e7313435380c7340b1868df03bb7d7aceab63e703f76c8be9ad487ea9a2b1ee78c36316d9
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszsbKY1xzpAIKn:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7V

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\hurok.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\hurok.exe	CryptoLocker_set1

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-02-12_80041a25539fcbaa8dfe99b3ecc05889_cryptolocker.exehurok.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	2024-02-12_80041a25539fcbaa8dfe99b3ecc05889_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	hurok.exe

Executes dropped EXE 1 IoCs

Processes:

hurok.exe

pid process

3076 hurok.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3076	hurok.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-02-12_80041a25539fcbaa8dfe99b3ecc05889_cryptolocker.exe

description	pid	process	target process
PID 640 wrote to memory of 3076	640	2024-02-12_80041a25539fcbaa8dfe99b3ecc05889_cryptolocker.exe	hurok.exe
PID 640 wrote to memory of 3076	640	2024-02-12_80041a25539fcbaa8dfe99b3ecc05889_cryptolocker.exe	hurok.exe
PID 640 wrote to memory of 3076	640	2024-02-12_80041a25539fcbaa8dfe99b3ecc05889_cryptolocker.exe	hurok.exe

C:\Users\Admin\AppData\Local\Temp\2024-02-12_80041a25539fcbaa8dfe99b3ecc05889_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-12_80041a25539fcbaa8dfe99b3ecc05889_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:640

C:\Users\Admin\AppData\Local\Temp\hurok.exe
"C:\Users\Admin\AppData\Local\Temp\hurok.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:3076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
49KB

MD5
0160ef8c684cecb7c8380de4bf3e53d5

SHA1
643718a5b4f8a48dda3df96cc7e574b4ff605722

SHA256
5d1f1ad9aabdc9e93c8c5fb46c2546d3792e526c855ee37a7045f8333bdb795d

SHA512
ca60e33b4a2bc48d7ac00821bc264d422b67ac9516037fb7068f40cae977e29aa0f78cb6d265bc9da4cde3c38d39f3957902356d51a4ef42dfbba812f641c742

Download Submit
C:\Users\Admin\AppData\Local\Temp\hurrok.exe

Filesize
1KB

MD5
60eda044a6c5a942bfbc042c8ff1600a

SHA1
b4cb0467c98f122bfa12ed35ae2ea063cf7eb020

SHA256
a90c278908a42b3438dcad9abe8a8bdf7b176d7c38d582a58cb36422880b9afd

SHA512
7cdf272f28602c2f6efde91cc7d44aa9f37e66401b0c1a27e5e75418e351fc89ad416367e97d10b8d22488dfa0b650d6e3eff3cbc0c43b3b9e65d20eb224d9f8

Download Submit
memory/640-0-0x0000000002040000-0x0000000002046000-memory.dmp

Filesize
24KB

Download
memory/640-1-0x0000000002040000-0x0000000002046000-memory.dmp

Filesize
24KB

Download
memory/640-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3076-21-0x0000000001FD0000-0x0000000001FD6000-memory.dmp

Filesize
24KB

Download