c2d2ba3440ead57b50f253a46ded94f0fc3676a622e34035fa281def6c298194

Analysis

max time kernel
135s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-23_faf996102965acce91f55ca6334586c3_cryptolocker.exe
Size

53KB
MD5

faf996102965acce91f55ca6334586c3
SHA1

c7c5fcd430975631728620c6b5d57fd002b6056a
SHA256

c2d2ba3440ead57b50f253a46ded94f0fc3676a622e34035fa281def6c298194
SHA512

9f1ecb93fc7862f2763b763b358255969b3756da6c8295900734f17394fa24bcbd11ab19cb43359ac6355b0cc58775f773eb3aeee2a79f0463ee29efdc495cbc
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszsbKY1xzpAIKx6Y:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7j

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\hurok.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\hurok.exe	CryptoLocker_set1

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

hurok.exe2024-05-23_faf996102965acce91f55ca6334586c3_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	hurok.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	2024-05-23_faf996102965acce91f55ca6334586c3_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

hurok.exe

pid process

1452 hurok.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1452	hurok.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-23_faf996102965acce91f55ca6334586c3_cryptolocker.exe

description	pid	process	target process
PID 764 wrote to memory of 1452	764	2024-05-23_faf996102965acce91f55ca6334586c3_cryptolocker.exe	hurok.exe
PID 764 wrote to memory of 1452	764	2024-05-23_faf996102965acce91f55ca6334586c3_cryptolocker.exe	hurok.exe
PID 764 wrote to memory of 1452	764	2024-05-23_faf996102965acce91f55ca6334586c3_cryptolocker.exe	hurok.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-23_faf996102965acce91f55ca6334586c3_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_faf996102965acce91f55ca6334586c3_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:764

C:\Users\Admin\AppData\Local\Temp\hurok.exe
"C:\Users\Admin\AppData\Local\Temp\hurok.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:1452

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe
Filesize
53KB

MD5
671c93f0cd314b122c35c658afcf1468

SHA1
37fb26f9c50a1b512124cb37784afcc6ce73b80d

SHA256
276f63adaba4aba4fb85101c06b01199ac1b9f359bb902eedfe7932a9fc5d88b

SHA512
945a2366f24137d4d4f7081a7518802494867109dd6d9fcb8a64c93b32da9021ffd917c8b9c9dbd7f169b3061310cb32fce3765f76032dc88ba64d74272a81d9

Download Submit
memory/764-0-0x0000000000520000-0x0000000000526000-memory.dmp

Filesize
24KB

Download
memory/764-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/764-8-0x0000000000520000-0x0000000000526000-memory.dmp

Filesize
24KB

Download
memory/1452-25-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download