9ad6f865a68a068bef24e7eff2dfebc4a35a2716ff422107b6e41faa747f6fc7

Analysis

max time kernel
115s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/02/2024, 01:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-29_b54fd48f6b34e335cda4fc1eb0b6361f_cryptolocker.exe
Size

49KB
MD5

b54fd48f6b34e335cda4fc1eb0b6361f
SHA1

611b95f78855a68043609d259029a00105e2a233
SHA256

9ad6f865a68a068bef24e7eff2dfebc4a35a2716ff422107b6e41faa747f6fc7
SHA512

6aa57a7ef3e3640977169a2f50c43c3d1d2653694087097b0bfce9fb0b6964a2e2e8b8101d736fb5521b675d02cb5bd01f6cb13405ed564d18cb741bb14ef4ad
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszsbKY1xzpAIKh:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7D

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 2 IoCs

resource	yara_rule
behavioral2/files/0x000800000001db2a-12.dat	CryptoLocker_rule2
behavioral2/files/0x000800000001db2a-14.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 2 IoCs

resource	yara_rule
behavioral2/files/0x000800000001db2a-12.dat	CryptoLocker_set1
behavioral2/files/0x000800000001db2a-14.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation	2024-02-29_b54fd48f6b34e335cda4fc1eb0b6361f_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation	hurok.exe

Executes dropped EXE 1 IoCs

pid	Process
3172	hurok.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3392 wrote to memory of 3172	3392	2024-02-29_b54fd48f6b34e335cda4fc1eb0b6361f_cryptolocker.exe	97
PID 3392 wrote to memory of 3172	3392	2024-02-29_b54fd48f6b34e335cda4fc1eb0b6361f_cryptolocker.exe	97
PID 3392 wrote to memory of 3172	3392	2024-02-29_b54fd48f6b34e335cda4fc1eb0b6361f_cryptolocker.exe	97

C:\Users\Admin\AppData\Local\Temp\2024-02-29_b54fd48f6b34e335cda4fc1eb0b6361f_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-29_b54fd48f6b34e335cda4fc1eb0b6361f_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=2972,i,4036376905309803364,5412922217215781933,262144 --variations-seed-version /prefetch:8
1⤵
PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
41KB

MD5
d6a8cfc2d886bab471e24464ec38bdc4

SHA1
f6706ae58852901e9bc1f9ddd1d3f8db203f51c1

SHA256
c5e022d0e0b0930f2fd0d5626fc8004df8445bc78098ec5458342c85f591c808

SHA512
63a131f01fbef254da72b17130cced2f050bf94970a7370992e38c4e309eb2d78d16d3da9775abaea0dbc3b8b4a7de846debf7d2d948036742b10e0d2c65d2b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
50KB

MD5
de39f91188b3f974ca139fbc2a4aa979

SHA1
9b4f8d27d14369b594e5de0986b3b40dc017a21d

SHA256
f00a4bffa9db2c9c150b229b1081763b7556296a52151c0612f49ed7da78532b

SHA512
ac42b4c757a931ac9609939340aaf0775fa7fd32fba32a4ffbb1fc6e26ebb0f15b243e25bb365a9052e25fa1fda945af8be5c52c33f273c77ca4a43d73ecb166

Download Submit
memory/3172-22-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/3392-0-0x0000000002310000-0x0000000002316000-memory.dmp

Filesize
24KB

Download
memory/3392-1-0x0000000002310000-0x0000000002316000-memory.dmp

Filesize
24KB

Download
memory/3392-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download