4a94d85b1d2bba502de4cc24b6bfaaf28b27437c2993bd22ae8192e5a3f85def

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18/02/2024, 00:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-18_191ca03f36c30b432885cfa3b6e45c2a_cryptolocker.exe
Size

49KB
MD5

191ca03f36c30b432885cfa3b6e45c2a
SHA1

0302c2107d302131584e8d86395bb457e039fa07
SHA256

4a94d85b1d2bba502de4cc24b6bfaaf28b27437c2993bd22ae8192e5a3f85def
SHA512

93bb98eb2fae805d571efe9ee1811ceb048f17f22501434f3e2db235ea8c08a0333fb9ba830d36652e8561c9035e12492bee44f1e484781b8d3c2e4c4cefce48
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszsbKY1xzpAIKJ:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7L

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000231fe-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000231fe-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation	2024-02-18_191ca03f36c30b432885cfa3b6e45c2a_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation	hurok.exe

Executes dropped EXE 1 IoCs

pid	Process
3692	hurok.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 180 wrote to memory of 3692	180	2024-02-18_191ca03f36c30b432885cfa3b6e45c2a_cryptolocker.exe	83
PID 180 wrote to memory of 3692	180	2024-02-18_191ca03f36c30b432885cfa3b6e45c2a_cryptolocker.exe	83
PID 180 wrote to memory of 3692	180	2024-02-18_191ca03f36c30b432885cfa3b6e45c2a_cryptolocker.exe	83

C:\Users\Admin\AppData\Local\Temp\2024-02-18_191ca03f36c30b432885cfa3b6e45c2a_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-18_191ca03f36c30b432885cfa3b6e45c2a_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:180
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
49KB

MD5
b6da5a7cbf9a645e54c6c50889634fef

SHA1
825697e98170135f1bf31c54b8ceeef8d50e3e6e

SHA256
9459b83a3f04ecae135c188f963d0c95fd876eaffb6d1679b09bd9017d38e210

SHA512
85682be3de246abf4f5d2b208bb1d2b0713fcbf90f3baeab34bf6fa42d0d0aa3e56627dd48bbedc3c71f45b0bda3081b538a19b0c3fd6d12e2ab0bb9622cd2bc

Download Submit
memory/180-0-0x0000000000520000-0x0000000000526000-memory.dmp

Filesize
24KB

Download
memory/180-1-0x0000000000520000-0x0000000000526000-memory.dmp

Filesize
24KB

Download
memory/180-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3692-21-0x0000000002140000-0x0000000002146000-memory.dmp

Filesize
24KB

Download