6d1c142e30682140019a8ca8bfe13cdb8bd622e5c61ef229d22329dbea2e382a

Analysis

max time kernel
136s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 00:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d1c142e30682140019a8ca8bfe13cdb8bd622e5c61ef229d22329dbea2e382a.exe
Size

36KB
MD5

735c8dc2924038a5f8b6d0a886c7e8b7
SHA1

e70fbff9b83fbf1394954f60aef9ce63d7cf382d
SHA256

6d1c142e30682140019a8ca8bfe13cdb8bd622e5c61ef229d22329dbea2e382a
SHA512

0a75ae8c39b79b175244b0b7eab7b953ba15689ba0b329656cab35a4e1fb287b26f51e4ec5238bf1394d4305f4b3a920c1ed2f809603cedeef4ebe4c594aac99
SSDEEP

768:Kf1K2exg2kBwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZsBGGp/YIm7wm0U6:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XV

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\hurok.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\hurok.exe	CryptoLocker_set1

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

hurok.exe6d1c142e30682140019a8ca8bfe13cdb8bd622e5c61ef229d22329dbea2e382a.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	hurok.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	6d1c142e30682140019a8ca8bfe13cdb8bd622e5c61ef229d22329dbea2e382a.exe

Executes dropped EXE 1 IoCs

Processes:

hurok.exe

pid process

1124 hurok.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1124	hurok.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

6d1c142e30682140019a8ca8bfe13cdb8bd622e5c61ef229d22329dbea2e382a.exe

description	pid	process	target process
PID 4432 wrote to memory of 1124	4432	6d1c142e30682140019a8ca8bfe13cdb8bd622e5c61ef229d22329dbea2e382a.exe	hurok.exe
PID 4432 wrote to memory of 1124	4432	6d1c142e30682140019a8ca8bfe13cdb8bd622e5c61ef229d22329dbea2e382a.exe	hurok.exe
PID 4432 wrote to memory of 1124	4432	6d1c142e30682140019a8ca8bfe13cdb8bd622e5c61ef229d22329dbea2e382a.exe	hurok.exe

C:\Users\Admin\AppData\Local\Temp\6d1c142e30682140019a8ca8bfe13cdb8bd622e5c61ef229d22329dbea2e382a.exe
"C:\Users\Admin\AppData\Local\Temp\6d1c142e30682140019a8ca8bfe13cdb8bd622e5c61ef229d22329dbea2e382a.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4432

C:\Users\Admin\AppData\Local\Temp\hurok.exe
"C:\Users\Admin\AppData\Local\Temp\hurok.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:1124

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe
Filesize
37KB

MD5
46644d8b9b9fd53fdc7978d6497576a7

SHA1
c2171122093484e3f72937e5e22fda2df5bf188b

SHA256
016540def5070608ad28b7756f0fa73b41712ba86f34f6e14055c8967747d6b6

SHA512
bfab07bee5038cd2de6cac8f1812f048d0db5120b52f1870245cf915a84f5f20c4c0808c6e7fc5b99460f83c0db6b80eeb6598631f1cdaa6916ec904940250dc

Download Submit
memory/1124-25-0x0000000000520000-0x0000000000526000-memory.dmp

Filesize
24KB

Download
memory/4432-0-0x0000000001FC0000-0x0000000001FC6000-memory.dmp

Filesize
24KB

Download
memory/4432-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4432-8-0x0000000001FC0000-0x0000000001FC6000-memory.dmp

Filesize
24KB

Download