d6a1420a8ea13798db198dc71b0834e60c58a8eaf46408c5d20b0e2b58813de3

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 23:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-22_3070c782a4d6762e10a206223cf2f56d_cryptolocker.exe
Size

65KB
MD5

3070c782a4d6762e10a206223cf2f56d
SHA1

26551122691ce18a7fa32180c89565411b79635e
SHA256

d6a1420a8ea13798db198dc71b0834e60c58a8eaf46408c5d20b0e2b58813de3
SHA512

6299e922f81313c4bb159643ecb60373593f2059d4d4f7aa82672f99fa533c1ef8c385b7f12a6d09a71d7ba60f7c9533beda40f57c436b09451fbe5cb9f2c26e
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszudnYTjipvF299NT:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7R

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\hurok.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\hurok.exe	CryptoLocker_set1

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-05-22_3070c782a4d6762e10a206223cf2f56d_cryptolocker.exehurok.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	2024-05-22_3070c782a4d6762e10a206223cf2f56d_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	hurok.exe

Executes dropped EXE 1 IoCs

Processes:

hurok.exe

pid process

2172 hurok.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2172	hurok.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-22_3070c782a4d6762e10a206223cf2f56d_cryptolocker.exe

description	pid	process	target process
PID 4296 wrote to memory of 2172	4296	2024-05-22_3070c782a4d6762e10a206223cf2f56d_cryptolocker.exe	hurok.exe
PID 4296 wrote to memory of 2172	4296	2024-05-22_3070c782a4d6762e10a206223cf2f56d_cryptolocker.exe	hurok.exe
PID 4296 wrote to memory of 2172	4296	2024-05-22_3070c782a4d6762e10a206223cf2f56d_cryptolocker.exe	hurok.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-22_3070c782a4d6762e10a206223cf2f56d_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_3070c782a4d6762e10a206223cf2f56d_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4296

C:\Users\Admin\AppData\Local\Temp\hurok.exe
"C:\Users\Admin\AppData\Local\Temp\hurok.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:2172

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe
Filesize
65KB

MD5
2575460f9aa3c3849fc73ce10a711d97

SHA1
9aaba5a90e5c5e3c9cfc60a416e8e329c5617715

SHA256
9c7898eaa5cdbb6524b500279e8f942b24781cac9a975f011f25d911897c3e62

SHA512
0a8e0843df4769968e827423d64186ef1f712f3aad4b3c97b38542b155bb526b5855d30eec94491ac3208c128778f6fa7b028dd21365986105736aa9edd80e58

Download Submit
memory/2172-25-0x0000000001FC0000-0x0000000001FC6000-memory.dmp

Filesize
24KB

Download
memory/4296-0-0x0000000000550000-0x0000000000556000-memory.dmp

Filesize
24KB

Download
memory/4296-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4296-1-0x0000000000550000-0x0000000000556000-memory.dmp

Filesize
24KB

Download