84ec4b4a7c5fa87107064b5cefb93ae4a3acdc30a7cc774647428f74c53cfe1a

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 04:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-20_a8016bca1fdb49d52109d3f6d9066d77_cryptolocker.exe
Size

49KB
MD5

a8016bca1fdb49d52109d3f6d9066d77
SHA1

012d2533d211ec25068ce64964ae13f164c69c31
SHA256

84ec4b4a7c5fa87107064b5cefb93ae4a3acdc30a7cc774647428f74c53cfe1a
SHA512

db925030d9feb0d6bdfb6f15e3d0d0800587c10379a6b3a7e91ab4ab944c86dff30f18f5153e71677de117929bc44c2afca5835aa992d2cd49c793197088f8ba
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszsbKY1x5hjatshC:aq7tdgI2MyzNORQtOflIwoHNV2XBFV73

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	2024-06-20_a8016bca1fdb49d52109d3f6d9066d77_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	hurok.exe

Executes dropped EXE 1 IoCs

pid	Process
3308	hurok.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 3308	1856	2024-06-20_a8016bca1fdb49d52109d3f6d9066d77_cryptolocker.exe	82
PID 1856 wrote to memory of 3308	1856	2024-06-20_a8016bca1fdb49d52109d3f6d9066d77_cryptolocker.exe	82
PID 1856 wrote to memory of 3308	1856	2024-06-20_a8016bca1fdb49d52109d3f6d9066d77_cryptolocker.exe	82

C:\Users\Admin\AppData\Local\Temp\2024-06-20_a8016bca1fdb49d52109d3f6d9066d77_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-20_a8016bca1fdb49d52109d3f6d9066d77_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
49KB

MD5
248c57f24125f106b5c01d07dfdb766b

SHA1
30d77447cf6aabd3963d598cacaebe0dd1aa5ce3

SHA256
7100e0e560a9e406eb092dd92f97816fdd078a2e9bbb7c60b1cbcc6e42c6d775

SHA512
6c4c938af5f94fd1ffd604f25179af2ba9d4a6ed3b4f10855ac98de33e4ba7c7ec57cfd4cb0b34f9af6c3ae1c1ebdd79cfa47183c1bdedb835584a74eb9abb59

Download Submit
memory/1856-0-0x00000000021B0000-0x00000000021B6000-memory.dmp

Filesize
24KB

Download
memory/1856-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1856-8-0x00000000021B0000-0x00000000021B6000-memory.dmp

Filesize
24KB

Download
memory/3308-25-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download