aa44dfb4175034004287b7f37ef7281acb907c1b8a7a38aa86581d2a5ee95fd2

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2024, 06:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-08-26_6fd47eab7ec89859c29cd99ba490ad1b_cryptolocker.exe
Size

55KB
MD5

6fd47eab7ec89859c29cd99ba490ad1b
SHA1

b7793b3f3f3d6c1835f5ce0c0d68e1ae3a131278
SHA256

aa44dfb4175034004287b7f37ef7281acb907c1b8a7a38aa86581d2a5ee95fd2
SHA512

d41f2e91766e89f73ac950782357ebd945b2d59a3186fb9388c8e67cdf7c8599036d6db103b6ee3749d85857deef425851c23f221e8b3124ee1bbe2f3429fe24
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszsbKY1xzpAI4kjmd:aq7tdgI2MyzNORQtOflIwoHNV2XBFV79

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	2024-08-26_6fd47eab7ec89859c29cd99ba490ad1b_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	hurok.exe

Executes dropped EXE 1 IoCs

pid	Process
3352	hurok.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-26_6fd47eab7ec89859c29cd99ba490ad1b_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hurok.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 3352	5092	2024-08-26_6fd47eab7ec89859c29cd99ba490ad1b_cryptolocker.exe	86
PID 5092 wrote to memory of 3352	5092	2024-08-26_6fd47eab7ec89859c29cd99ba490ad1b_cryptolocker.exe	86
PID 5092 wrote to memory of 3352	5092	2024-08-26_6fd47eab7ec89859c29cd99ba490ad1b_cryptolocker.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-08-26_6fd47eab7ec89859c29cd99ba490ad1b_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-26_6fd47eab7ec89859c29cd99ba490ad1b_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
55KB

MD5
15fee47b3fefb7630fa3f0b1570d659a

SHA1
0f2042268f31283bf5da36fe2668e1cc5e976aab

SHA256
0473c7a730b6aed1cb9f2a8ca5871cf32a205c7da0cee5b78e966f99f5d712e8

SHA512
b6d2553e8a75281ceb895296f22b180116c5389a838c1412d671619cdfc918fb5b6b8d83effd0637c2c8b7c98878b1aca34376319aeebcbbe57e53854ffca42a

Download Submit
memory/3352-19-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/5092-0-0x0000000000670000-0x0000000000676000-memory.dmp

Filesize
24KB

Download
memory/5092-1-0x0000000000670000-0x0000000000676000-memory.dmp

Filesize
24KB

Download
memory/5092-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download