5d5c0c96e1a9bd07f2d0ed15b60850a9844df5d9d5337c791f72c1da1063252e

Analysis

max time kernel
88s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 07:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-14_90f35bd1d700a54d4642a50eec06d8d4_cryptolocker.exe
Size

61KB
MD5

90f35bd1d700a54d4642a50eec06d8d4
SHA1

62a2b925914c1cde6bdc6c47613095b7f716887e
SHA256

5d5c0c96e1a9bd07f2d0ed15b60850a9844df5d9d5337c791f72c1da1063252e
SHA512

d5448261bc1d8ada589dd9b729a0afe5a95bc1beb8a1e42829953880476dd98400ab457d8390629684a0c63f5e03ee50e0bc756846649eb4fd981f5a7088594b
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszudnYTjipvF293sh:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7u

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x00080000000231fb-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x00080000000231fb-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	2024-02-14_90f35bd1d700a54d4642a50eec06d8d4_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	hurok.exe

Executes dropped EXE 1 IoCs

pid	Process
3236	hurok.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 3236	4248	2024-02-14_90f35bd1d700a54d4642a50eec06d8d4_cryptolocker.exe	84
PID 4248 wrote to memory of 3236	4248	2024-02-14_90f35bd1d700a54d4642a50eec06d8d4_cryptolocker.exe	84
PID 4248 wrote to memory of 3236	4248	2024-02-14_90f35bd1d700a54d4642a50eec06d8d4_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-02-14_90f35bd1d700a54d4642a50eec06d8d4_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-14_90f35bd1d700a54d4642a50eec06d8d4_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
62KB

MD5
1e09ec7499f43917bd5efc27c12f4322

SHA1
346e4a1eb1f5c99049ec2ce59b06d62448e6266d

SHA256
be74bef284c3d79f94dc98b2d4f509b75a88e7bc4deb2b9866da6e95b7cd95e9

SHA512
077721de8849bc9f30e1b7b29d951a051bf61f75289800775eb1a1e19c2dddb317c0e1b80482ae5410125cdd1922a49cc539776ab391675a1906388a23ba9ee9

Download Submit
C:\Users\Admin\AppData\Local\Temp\hurrok.exe

Filesize
1KB

MD5
90fdb231081d6d5a12bf345040bf3438

SHA1
e77cf0f264ce15f765007b5ce391233cbe1db4ca

SHA256
b4b5287e1e72e15a06ce7a141395e3e7adc8a2cab7f887732a165172fb382ffb

SHA512
fe4bbabf36fcf7d5b102d3d1effe456919304389126bd69aae51376f21841d2226e2c7a4b8fd035d739e73b209525523b6b3a9f8c2fd0925841c84f3adb2fbf4

Download Submit
memory/3236-25-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/4248-0-0x0000000002270000-0x0000000002276000-memory.dmp

Filesize
24KB

Download
memory/4248-1-0x0000000002270000-0x0000000002276000-memory.dmp

Filesize
24KB

Download
memory/4248-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download