6c9ada02fb53acf740a865f8c78ea440984dd4eaea9f5e6192691de6fab09ade

Analysis

max time kernel
93s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 19:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-22_9c27242f10b303ef9991ed9980565dc4_cryptolocker.exe
Size

31KB
MD5

9c27242f10b303ef9991ed9980565dc4
SHA1

46e31661a7fb8be11e48b09867461812d866aac1
SHA256

6c9ada02fb53acf740a865f8c78ea440984dd4eaea9f5e6192691de6fab09ade
SHA512

0322b9bc2c90561b60c6786fe71f2a2cf6bd3de9aa99d9aa4f6c2f1f34c2018138e40eef155cb79b1d8e0bc33e99aa46397e7e63caa1dce23cad00e1cfe16a24
SSDEEP

768:Kf1K2exg2kBwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZsBGGbNAKSjNfS:o1KhxqwtdgI2MyzNORQtOflIwoHNV2Xb

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\hurok.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\hurok.exe	CryptoLocker_set1

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-05-22_9c27242f10b303ef9991ed9980565dc4_cryptolocker.exehurok.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	2024-05-22_9c27242f10b303ef9991ed9980565dc4_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	hurok.exe

Executes dropped EXE 1 IoCs

Processes:

hurok.exe

pid process

772 hurok.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
772	hurok.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-22_9c27242f10b303ef9991ed9980565dc4_cryptolocker.exe

description	pid	process	target process
PID 780 wrote to memory of 772	780	2024-05-22_9c27242f10b303ef9991ed9980565dc4_cryptolocker.exe	hurok.exe
PID 780 wrote to memory of 772	780	2024-05-22_9c27242f10b303ef9991ed9980565dc4_cryptolocker.exe	hurok.exe
PID 780 wrote to memory of 772	780	2024-05-22_9c27242f10b303ef9991ed9980565dc4_cryptolocker.exe	hurok.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-22_9c27242f10b303ef9991ed9980565dc4_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_9c27242f10b303ef9991ed9980565dc4_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:780
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
31KB

MD5
c133a3ad86cfbf9cd6367ddc70605d6c

SHA1
06ca676ff321e9ba3b20b2cd39d241a1fd17aa1d

SHA256
cae54d6863379388e070e01d81a2aed01a70f44b83c0892cea463fc627cb7d1e

SHA512
77c822fab2ed5193a7b9126546af7aca52bc273be18b7966af96ec4c14d348a2d5da56e9ee84052066903638ce00dea5c625afb38657cf947251e8c5cf7fe19c

Download Submit
memory/772-25-0x0000000001F40000-0x0000000001F46000-memory.dmp

Filesize
24KB

Download
memory/780-0-0x0000000002130000-0x0000000002136000-memory.dmp

Filesize
24KB

Download
memory/780-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/780-8-0x0000000002130000-0x0000000002136000-memory.dmp

Filesize
24KB

Download