72822f7471f6062e2bccc0c93658e42cf55f44ba311e713fbc7c103d60a0231c

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05-07-2024 06:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-07-05_955f304865f10d48ce98a733200b6fdb_cryptolocker.exe
Size

30KB
MD5

955f304865f10d48ce98a733200b6fdb
SHA1

f96b1bfe0ed7e8d1cbfae39b35edc746d48ee4e0
SHA256

72822f7471f6062e2bccc0c93658e42cf55f44ba311e713fbc7c103d60a0231c
SHA512

2beba5bdb38777924dafd5c6df969d74853c267e2b9fcc8ef945174e297d7ffb46b9bdf4f0d563537a4db6bf36531da47fc790bc25c55c39f35f96cdefbd1211
SSDEEP

768:Kf1K2exg2kBwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZsBGGbNAKSjNfU:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XR

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	2024-07-05_955f304865f10d48ce98a733200b6fdb_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1752	hurok.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 1752	4600	2024-07-05_955f304865f10d48ce98a733200b6fdb_cryptolocker.exe	81
PID 4600 wrote to memory of 1752	4600	2024-07-05_955f304865f10d48ce98a733200b6fdb_cryptolocker.exe	81
PID 4600 wrote to memory of 1752	4600	2024-07-05_955f304865f10d48ce98a733200b6fdb_cryptolocker.exe	81

C:\Users\Admin\AppData\Local\Temp\2024-07-05_955f304865f10d48ce98a733200b6fdb_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-05_955f304865f10d48ce98a733200b6fdb_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Executes dropped EXE
  PID:1752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
30KB

MD5
83ee1f5ef089570c307f71a18c395da6

SHA1
b3b2e4110f65b2ca5062c83a4f460be4c63886c4

SHA256
174a360b252e11fd5123f533e6e450c1b8c03724f51158c6b084b88daf69904d

SHA512
ea5f7c2f01ff45b97bd6ea6aa1891f066fb8e1ceb085793366c8daf32f97a66f95c40520787ad962f37d803110ac6ad8ba37b0af0f52c24fcc3ee1d87ff313cc

Download Submit
memory/1752-25-0x0000000002040000-0x0000000002046000-memory.dmp

Filesize
24KB

Download
memory/4600-0-0x00000000020C0000-0x00000000020C6000-memory.dmp

Filesize
24KB

Download
memory/4600-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4600-8-0x00000000020C0000-0x00000000020C6000-memory.dmp

Filesize
24KB

Download