6004bba52071aed61a39352b400f028252eb2e17b16de9e253b00ef8f6bd700e

Analysis

max time kernel
134s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 16:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-21_71fe49b0438083c07225e3dd0fdacee5_cryptolocker.exe
Size

45KB
MD5

71fe49b0438083c07225e3dd0fdacee5
SHA1

bef2c43717ca2c69634df5eec68cb6fc1f9664ed
SHA256

6004bba52071aed61a39352b400f028252eb2e17b16de9e253b00ef8f6bd700e
SHA512

faab941de16c6d431e47415f8be3aa84e445417375237fafbeb26a9706c79731a14575163b5fead4dafd3944a58cca5dba561c06f71e04b70d7c25fe58b2246c
SSDEEP

768:Kf1K2exg2kBwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZsBGGpebVIYLHA3KxE:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XV

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\hurok.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\hurok.exe	CryptoLocker_set1

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-05-21_71fe49b0438083c07225e3dd0fdacee5_cryptolocker.exehurok.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	2024-05-21_71fe49b0438083c07225e3dd0fdacee5_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	hurok.exe

Executes dropped EXE 1 IoCs

Processes:

hurok.exe

pid process

4336 hurok.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4336	hurok.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-21_71fe49b0438083c07225e3dd0fdacee5_cryptolocker.exe

description	pid	process	target process
PID 3472 wrote to memory of 4336	3472	2024-05-21_71fe49b0438083c07225e3dd0fdacee5_cryptolocker.exe	hurok.exe
PID 3472 wrote to memory of 4336	3472	2024-05-21_71fe49b0438083c07225e3dd0fdacee5_cryptolocker.exe	hurok.exe
PID 3472 wrote to memory of 4336	3472	2024-05-21_71fe49b0438083c07225e3dd0fdacee5_cryptolocker.exe	hurok.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-21_71fe49b0438083c07225e3dd0fdacee5_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-21_71fe49b0438083c07225e3dd0fdacee5_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3472

C:\Users\Admin\AppData\Local\Temp\hurok.exe
"C:\Users\Admin\AppData\Local\Temp\hurok.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:4336

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe
Filesize
45KB

MD5
b790967db6840cb5cf752e22d699643c

SHA1
85abacbe4a0e709b2321582ab35e6b6d9dbfa73f

SHA256
d55405a150dfcbb1177d4706b1d41ebf53eeec713e0c330d8e270f7950b9d7ca

SHA512
646493afb9f221243c51648e223a45b6a517e5d60e021ba3d9ddc6f2c099314c2c6000d870cf113f765a60a4a44c540dbbff4be31a378e77af2015771eac2ecb

Download Submit
memory/3472-0-0x0000000000550000-0x0000000000556000-memory.dmp

Filesize
24KB

Download
memory/3472-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3472-8-0x0000000000550000-0x0000000000556000-memory.dmp

Filesize
24KB

Download
memory/4336-25-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download