76e38d7acc9831f75a9a09963db063da16d2ab75f9db0d446ccb8b1da1461020

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-22_dd42dc0052a836f1f6c476cde38025b4_cryptolocker.exe
Size

45KB
MD5

dd42dc0052a836f1f6c476cde38025b4
SHA1

110a2fa5bcd8242eb4024e16690e259216a5c86c
SHA256

76e38d7acc9831f75a9a09963db063da16d2ab75f9db0d446ccb8b1da1461020
SHA512

cc29fe874164b562bf3b0f8b95d7235fc6dd6eb1c8f72d65eff42ecdf1034320bc7aae1d988bd8773d4245965529a76d16ac5b8a6f6cbdcfcf65c62da9c96b0d
SSDEEP

768:Kf1K2exg2kBwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZsBGGpebVIYLHA3Kxv:o1KhxqwtdgI2MyzNORQtOflIwoHNV2Xy

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\hurok.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\hurok.exe	CryptoLocker_set1

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-05-22_dd42dc0052a836f1f6c476cde38025b4_cryptolocker.exehurok.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	2024-05-22_dd42dc0052a836f1f6c476cde38025b4_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	hurok.exe

Executes dropped EXE 1 IoCs

Processes:

hurok.exe

pid process

1764 hurok.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1764	hurok.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-22_dd42dc0052a836f1f6c476cde38025b4_cryptolocker.exe

description	pid	process	target process
PID 4032 wrote to memory of 1764	4032	2024-05-22_dd42dc0052a836f1f6c476cde38025b4_cryptolocker.exe	hurok.exe
PID 4032 wrote to memory of 1764	4032	2024-05-22_dd42dc0052a836f1f6c476cde38025b4_cryptolocker.exe	hurok.exe
PID 4032 wrote to memory of 1764	4032	2024-05-22_dd42dc0052a836f1f6c476cde38025b4_cryptolocker.exe	hurok.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-22_dd42dc0052a836f1f6c476cde38025b4_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_dd42dc0052a836f1f6c476cde38025b4_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4032

C:\Users\Admin\AppData\Local\Temp\hurok.exe
"C:\Users\Admin\AppData\Local\Temp\hurok.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:1764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
45KB

MD5
a4af31bbeea7656bdd860d3ae089f91a

SHA1
794bb1b6edea675f2fe222142752c806cf09b866

SHA256
34cec68328da0106cb0efa8070041a552d89b28ff2df0dd55169e76cf750fab8

SHA512
1db5908a2bc88b81182706d7784242ef7ed251bfb83ed0ccd3112cbf11633f31f7402a7661e1c4390062167ecde6afce6b56e4203b1baa389fc3152ce6f94164

Download Submit
memory/1764-25-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/4032-0-0x0000000000590000-0x0000000000596000-memory.dmp

Filesize
24KB

Download
memory/4032-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4032-8-0x0000000000590000-0x0000000000596000-memory.dmp

Filesize
24KB

Download