ef6a182c7a8425b279fe3c29fd7ce0f885dfa2a2bc48eabc6e4ec0249f5c19da

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23/02/2024, 04:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-23_5aa524730473fed7ac5970c3d2876e9a_cryptolocker.exe
Size

62KB
MD5

5aa524730473fed7ac5970c3d2876e9a
SHA1

00817e393d7c4874ea62a03f70684fdea1f2531b
SHA256

ef6a182c7a8425b279fe3c29fd7ce0f885dfa2a2bc48eabc6e4ec0249f5c19da
SHA512

cac95cfff73fa8f263f81d952a4bc92dfcbc920b98441595cca55d0c439587a983b35f1ae365f1efc40d74d4d223796ab4cec1f3d67ec550fd5abc9c8dddb480
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszsbKY1x/9lfL+gniDScG+:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7X

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000600000002312f-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x000600000002312f-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\Control Panel\International\Geo\Nation	2024-02-23_5aa524730473fed7ac5970c3d2876e9a_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\Control Panel\International\Geo\Nation	hurok.exe

Executes dropped EXE 1 IoCs

pid	Process
4456	hurok.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 4456	2600	2024-02-23_5aa524730473fed7ac5970c3d2876e9a_cryptolocker.exe	86
PID 2600 wrote to memory of 4456	2600	2024-02-23_5aa524730473fed7ac5970c3d2876e9a_cryptolocker.exe	86
PID 2600 wrote to memory of 4456	2600	2024-02-23_5aa524730473fed7ac5970c3d2876e9a_cryptolocker.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-02-23_5aa524730473fed7ac5970c3d2876e9a_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-23_5aa524730473fed7ac5970c3d2876e9a_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
63KB

MD5
fd15d7b40d9cb3b4d0c0720a51c00762

SHA1
2cb8411585c742d3a0ed40e6c6818bd7f17d886e

SHA256
edd90674367ae41077093f5f24b6617d5582f0b3bb1acf8aee88031716f84c63

SHA512
c9c6a43790a56df70b2b37a3024f7d322c0ac089d8991c9f9c489c2a14e47cc410aaf60f224e999508cabaa0d8211e5d2aa5b3aa30ef81050083e7d869327d9e

Download Submit
memory/2600-0-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/2600-1-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/2600-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4456-21-0x0000000002040000-0x0000000002046000-memory.dmp

Filesize
24KB

Download