fb576db2c4d9a170fe5b24339434011230e009fc33d5ce91671dc82004a52bc0

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/02/2024, 20:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-12_b0d5ad9eac0e497f83f76e70d23af1de_cryptolocker.exe
Size

49KB
MD5

b0d5ad9eac0e497f83f76e70d23af1de
SHA1

30053648bb5555495f1563915cbb7db79978138c
SHA256

fb576db2c4d9a170fe5b24339434011230e009fc33d5ce91671dc82004a52bc0
SHA512

ebb5ec53c4ff606b2169bbfed7e21b0f237772a3ec6fdbf1fb1afb117759f6a4a3c006ac86ef40ebc2df57c03f8812f5b17e901ca1e65a03ff6d61369cd07117
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszsbKY1xzpAIK+:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7g

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x00060000000231f6-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x00060000000231f6-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	2024-02-12_b0d5ad9eac0e497f83f76e70d23af1de_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	hurok.exe

Executes dropped EXE 1 IoCs

pid	Process
2368	hurok.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2368	3012	2024-02-12_b0d5ad9eac0e497f83f76e70d23af1de_cryptolocker.exe	84
PID 3012 wrote to memory of 2368	3012	2024-02-12_b0d5ad9eac0e497f83f76e70d23af1de_cryptolocker.exe	84
PID 3012 wrote to memory of 2368	3012	2024-02-12_b0d5ad9eac0e497f83f76e70d23af1de_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-02-12_b0d5ad9eac0e497f83f76e70d23af1de_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-12_b0d5ad9eac0e497f83f76e70d23af1de_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
49KB

MD5
83bb08194751cfe59973ecc26c27ae2c

SHA1
ce67da28b714a49893ba4e93a8cd7423484380a0

SHA256
68be44be69fdb21d245e8ba9163313380c20e2e44d5ba89f4219c9c57d88ed3a

SHA512
d05d168b06ab3d5b4be6da32ddf33275862662dc1ea864e2238cc4204a49b33cf968956d990d49a1ffa4791a337e9e158324b3090ff6fcf365854e186995bd60

Download Submit
C:\Users\Admin\AppData\Local\Temp\hurrok.exe

Filesize
1KB

MD5
1aa94f88abfbd2df7685ec25b920e912

SHA1
07036a3683592819aa3b8f47116853e0c3656ec1

SHA256
37bd9fc2f5899baedbbd2580bcd9ff68cab23baeebd164258ba29e0e76400245

SHA512
b98132fc6966fe9529f775bda307dd92000cf503aa9234436f25b067aca42378e46ca958c3143a51f754a8472181c0d866f0a38b05ff11284983d2a6d035e954

Download Submit
memory/2368-25-0x0000000000580000-0x0000000000586000-memory.dmp

Filesize
24KB

Download
memory/3012-0-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/3012-1-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/3012-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download