a08527f653acf5a6fbf5f19cb3f6eed3a62e2de34b168afcc67542874c4fb93d

Analysis

max time kernel
134s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 19:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

20240521668c0bf4b7f161769921c15317db6b65cryptolocker.exe
Size

38KB
MD5

668c0bf4b7f161769921c15317db6b65
SHA1

a0cc35f8074a8bf0d5cfcbaec2c4de403ef9d18b
SHA256

a08527f653acf5a6fbf5f19cb3f6eed3a62e2de34b168afcc67542874c4fb93d
SHA512

3a52ee7624478ae16eb65bd16b6899e79ffe5b02d4e0779dbe020afdbfd941e00818cc96e2467b8060cf8b38ee859165aa960a03de676c279a6a2a8270376e62
SSDEEP

768:Kf1K2exg2kBwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZsBGGp/YIm7wm0WZyS:o1KhxqwtdgI2MyzNORQtOflIwoHNV2X4

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	20240521668c0bf4b7f161769921c15317db6b65cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	hurok.exe

Executes dropped EXE 1 IoCs

pid	Process
1512	hurok.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4024 wrote to memory of 1512	4024	20240521668c0bf4b7f161769921c15317db6b65cryptolocker.exe	92
PID 4024 wrote to memory of 1512	4024	20240521668c0bf4b7f161769921c15317db6b65cryptolocker.exe	92
PID 4024 wrote to memory of 1512	4024	20240521668c0bf4b7f161769921c15317db6b65cryptolocker.exe	92

C:\Users\Admin\AppData\Local\Temp\20240521668c0bf4b7f161769921c15317db6b65cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\20240521668c0bf4b7f161769921c15317db6b65cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4024
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:1512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3824,i,13281073920029625837,8253721632651544158,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:8
1⤵
PID:3812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
38KB

MD5
1d6030ee15a1c977c16e2f643a915401

SHA1
20efc009e6ab9880b2a9103616bc6118629e7d94

SHA256
6e1a641d8305410dd5a45d38bc02940d7829dfa59faba8d071c806f1f70620a2

SHA512
6de16d12fe1ed6fea8db8315959b45fd78c879ee0f2ec075b9e014cbd1084fda2684e2884735b5af70129bc4f3be63dbc6f27efdcd30c3cdadafc95688a925d3

Download Submit
memory/1512-25-0x00000000020D0000-0x00000000020D6000-memory.dmp

Filesize
24KB

Download
memory/4024-0-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/4024-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4024-8-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download