4b6dc5410005625f8cdb4254d809ddee6bc78b605fec41175bbf103f54d98a5d

Analysis

max time kernel
144s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 00:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-14_7d48d09c2f5c629f6eaffb5c795c8639_cryptolocker.exe
Size

61KB
MD5

7d48d09c2f5c629f6eaffb5c795c8639
SHA1

dc3995493596515ea0fd2e2adf3018454c1b3db5
SHA256

4b6dc5410005625f8cdb4254d809ddee6bc78b605fec41175bbf103f54d98a5d
SHA512

1e2358e8a3449f6094630d303696becc874f9b6f98e964b7e0a83ac268901735fa1a7b5db10f4c35a05178d252ebc7e428ed6b4bacbed5513cd39aa2981ae519
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszsbKY1x/9lfL+gniDSAap:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7e

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000700000002320f-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x000700000002320f-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	hurok.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	2024-02-14_7d48d09c2f5c629f6eaffb5c795c8639_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
4088	hurok.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 4088	2656	2024-02-14_7d48d09c2f5c629f6eaffb5c795c8639_cryptolocker.exe	85
PID 2656 wrote to memory of 4088	2656	2024-02-14_7d48d09c2f5c629f6eaffb5c795c8639_cryptolocker.exe	85
PID 2656 wrote to memory of 4088	2656	2024-02-14_7d48d09c2f5c629f6eaffb5c795c8639_cryptolocker.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-02-14_7d48d09c2f5c629f6eaffb5c795c8639_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-14_7d48d09c2f5c629f6eaffb5c795c8639_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
61KB

MD5
dbafca0382a51d5da2eaa0d652241359

SHA1
b268a7adc1da0d41d0eafc784bf094ae2ade8523

SHA256
7cc843ef8a52fcf307ec895b0866633e511b284c8786c741712f591eb8270878

SHA512
e3da8c31f41311e72b4f5dca59eb9692016040bfb7991c0bd499b03177159f725bbe754f0a2806456bd3287dab366113539b64975a705717b3b8fadeed9555db

Download Submit
C:\Users\Admin\AppData\Local\Temp\hurrok.exe

Filesize
1KB

MD5
069f14c026b716ceb548211397615efd

SHA1
305e6f9ee39f60f79d0c91663722553de6401923

SHA256
dd5e08c77c7969073318cde17f9ca9f5511bb16dfba51e5b9ed2e51cc6a72445

SHA512
1601586ab929df373bd6bf3688efa709933e78ba746ae27c869cbf8cd2b35d69e879393eda2cdccc61cccd954f0f8d9880d38729be0879a7600c11d4910b7c2b

Download Submit
memory/2656-0-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/2656-1-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/2656-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4088-23-0x0000000000590000-0x0000000000596000-memory.dmp

Filesize
24KB

Download