01c79dabf2654a02927197483b234f5be3542657aa74294d1d0bc75cace71c08

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14-02-2024 13:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-14_7999d342e8eba15b1d8cbc80feee5439_cryptolocker.exe
Size

61KB
MD5

7999d342e8eba15b1d8cbc80feee5439
SHA1

c48827039318ce15dc1d4b82913b5ec370f7ae7a
SHA256

01c79dabf2654a02927197483b234f5be3542657aa74294d1d0bc75cace71c08
SHA512

4c976df7ef0fbe6b275e62f635ed0420b43be6b2be9b9b70d06fb0360ad34fe1dcb95081c8d7ad1ff3ada58ece4c3fb6a855b695e6dd20606a5b3414b506d0d5
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszudnYTjipvF293s4:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7r

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000231ff-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000231ff-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	2024-02-14_7999d342e8eba15b1d8cbc80feee5439_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	hurok.exe

Executes dropped EXE 1 IoCs

pid	Process
3496	hurok.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 3496	1288	2024-02-14_7999d342e8eba15b1d8cbc80feee5439_cryptolocker.exe	83
PID 1288 wrote to memory of 3496	1288	2024-02-14_7999d342e8eba15b1d8cbc80feee5439_cryptolocker.exe	83
PID 1288 wrote to memory of 3496	1288	2024-02-14_7999d342e8eba15b1d8cbc80feee5439_cryptolocker.exe	83

C:\Users\Admin\AppData\Local\Temp\2024-02-14_7999d342e8eba15b1d8cbc80feee5439_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-14_7999d342e8eba15b1d8cbc80feee5439_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
62KB

MD5
70ba92409abcc61071eaff8df17dac0c

SHA1
e5c93a5389239713f9e60fcf232c08336e8cde63

SHA256
4ddbd83d391b3a5c5c5587a9da3259692c5c85ab08b74c045f0361ccd99d27f7

SHA512
7df6d3a5edbb42676b4b4f87422ae21f0b5ce4ea19cee5ef854ad83ea08db01a14476d538ce311e99f0f9fec1ffd665a428e841ee63276e98b0bd44683c452c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\hurrok.exe

Filesize
1KB

MD5
0e8e500a88ff2aa378f05d35dcf80571

SHA1
576c4e46cfe16f42f7adece3369b5d0254268551

SHA256
1af4a53835a38f0652847337ae216a4ca3faae578c2dfaf399226c8008e42231

SHA512
1809c6485b98169dd1a6b66b2f315c843ef1e13790b5cce7ed2a9ab8bbd3ef95ed5c5bfc65a43b2f546643652b97fb502f4f55bc0c2b46c09c46729bb5453f45

Download Submit
memory/1288-0-0x0000000002200000-0x0000000002206000-memory.dmp

Filesize
24KB

Download
memory/1288-1-0x0000000002200000-0x0000000002206000-memory.dmp

Filesize
24KB

Download
memory/1288-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3496-25-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download