235da3fa141124704acc2a2a6288038251f75f17ad802e598a2e9823278e8392

Analysis

max time kernel
139s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2024, 17:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-29_fd3f2ee71d368b672bec846331ba6da7_cryptolocker.exe
Size

39KB
MD5

fd3f2ee71d368b672bec846331ba6da7
SHA1

c10474c8d806b331943fb3d2c3d53055bdda6519
SHA256

235da3fa141124704acc2a2a6288038251f75f17ad802e598a2e9823278e8392
SHA512

3bb61dff60074f6c8b1d34795ab74cbae16aba97f91e794571530e059d3fab7690fac260eb13c6bc96f92cd71f8a06366cfd87c76325614f0e0121131730d673
SSDEEP

768:Kf1K2exg2kBwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZsBGGp/YIm7wm0WZyb:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XV

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	2024-06-29_fd3f2ee71d368b672bec846331ba6da7_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	hurok.exe

Executes dropped EXE 1 IoCs

pid	Process
4240	hurok.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 4240	2964	2024-06-29_fd3f2ee71d368b672bec846331ba6da7_cryptolocker.exe	90
PID 2964 wrote to memory of 4240	2964	2024-06-29_fd3f2ee71d368b672bec846331ba6da7_cryptolocker.exe	90
PID 2964 wrote to memory of 4240	2964	2024-06-29_fd3f2ee71d368b672bec846331ba6da7_cryptolocker.exe	90

C:\Users\Admin\AppData\Local\Temp\2024-06-29_fd3f2ee71d368b672bec846331ba6da7_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-29_fd3f2ee71d368b672bec846331ba6da7_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3812 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
1⤵
PID:3404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
40KB

MD5
673ca197c23d46bb26126379b1919973

SHA1
42d86c5ec75180db322da8351873856ea4d19b3e

SHA256
494a13ff9f479e5c46ff51649db2375f184242ffc56a95c87ebbb37236aababd

SHA512
2ce9f2fdffa334a5e33022fd9882042f41e9177c0e3cf3a32afaedcf9e85992c074057be2b66ab0f1a1eabac3e4c4970d751e8a04f1f514a0a65367a9be72326

Download Submit
memory/2964-0-0x0000000002200000-0x0000000002206000-memory.dmp

Filesize
24KB

Download
memory/2964-1-0x0000000002200000-0x0000000002206000-memory.dmp

Filesize
24KB

Download
memory/2964-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4240-23-0x0000000000590000-0x0000000000596000-memory.dmp

Filesize
24KB

Download