a36f98ba74aef1b3b10e33a8b52beae4e3ff2050ffea9e1d988c20a269e3ecfe

Analysis

max time kernel
141s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2024, 11:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-04-06_5b41cb7d5850be21687cb61ada6e7d8b_cryptolocker.exe
Size

36KB
MD5

5b41cb7d5850be21687cb61ada6e7d8b
SHA1

579ed0a29614b0e3438392c79c0cf2253a1bc91a
SHA256

a36f98ba74aef1b3b10e33a8b52beae4e3ff2050ffea9e1d988c20a269e3ecfe
SHA512

e0dc2d04eaccc7dee7daedce8ab60558fc50fd0d82f36c65b8fe1f2533b3bf3aa9b6433a89906d0b1d4b097911821aea11a2f87538a542fac254d95a7bc50409
SSDEEP

768:Kf1K2exg2kBwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZsBGGp/YIm7wmZshDh:o1KhxqwtdgI2MyzNORQtOflIwoHNV2Xn

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000400000001db72-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x000400000001db72-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation	2024-04-06_5b41cb7d5850be21687cb61ada6e7d8b_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation	hurok.exe

Executes dropped EXE 1 IoCs

pid	Process
3436	hurok.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 3436	3308	2024-04-06_5b41cb7d5850be21687cb61ada6e7d8b_cryptolocker.exe	94
PID 3308 wrote to memory of 3436	3308	2024-04-06_5b41cb7d5850be21687cb61ada6e7d8b_cryptolocker.exe	94
PID 3308 wrote to memory of 3436	3308	2024-04-06_5b41cb7d5850be21687cb61ada6e7d8b_cryptolocker.exe	94

C:\Users\Admin\AppData\Local\Temp\2024-04-06_5b41cb7d5850be21687cb61ada6e7d8b_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-06_5b41cb7d5850be21687cb61ada6e7d8b_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4252 --field-trial-handle=2224,i,17688331074622862378,73816879873678745,262144 --variations-seed-version /prefetch:8
1⤵
PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
37KB

MD5
f274e2ec39a705229dc67fbd48c579d5

SHA1
2bdaecf0e3b0144ba9e9263dfe610381e9d2601c

SHA256
9fb8d038f17a472201ff947f1553d601c34361f3d630c3e442d6277117a72dba

SHA512
c6be69bd58a1db6a0a63d26b1f3bec8ac5a1cc2e75f9df074dbe998060248eff430edd3aa9d94f009f78552729e1a581438ee543b0d3fe42ea8e7fb7fa5febce

Download Submit
memory/3308-0-0x0000000002300000-0x0000000002306000-memory.dmp

Filesize
24KB

Download
memory/3308-1-0x0000000002300000-0x0000000002306000-memory.dmp

Filesize
24KB

Download
memory/3308-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3436-24-0x00000000021C0000-0x00000000021C6000-memory.dmp

Filesize
24KB

Download