9ffab2c10b6fb53d76d09b6491e41973f4340f00c812f46ff8706966a18e3174

Analysis

max time kernel
94s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-09-12_b753ab1d9adb4b3278886f142e88f330_cryptolocker.exe
Size

67KB
MD5

b753ab1d9adb4b3278886f142e88f330
SHA1

1a338a7fac24b86c23d180c0dfdebaad979dc99f
SHA256

9ffab2c10b6fb53d76d09b6491e41973f4340f00c812f46ff8706966a18e3174
SHA512

7c2b2ad765dc8f1965f14ad2471317bbbacb1f52c08a506d3b176c68f2f45e7fbbf9a3de1c3464f785aec85edb751187b73273d1f99d2cbcc63af19e4a7fa0ec
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszudnYTjipvF299N2UE:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7Q

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	hurok.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	2024-09-12_b753ab1d9adb4b3278886f142e88f330_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
4804	hurok.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-12_b753ab1d9adb4b3278886f142e88f330_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hurok.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3268 wrote to memory of 4804	3268	2024-09-12_b753ab1d9adb4b3278886f142e88f330_cryptolocker.exe	84
PID 3268 wrote to memory of 4804	3268	2024-09-12_b753ab1d9adb4b3278886f142e88f330_cryptolocker.exe	84
PID 3268 wrote to memory of 4804	3268	2024-09-12_b753ab1d9adb4b3278886f142e88f330_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-09-12_b753ab1d9adb4b3278886f142e88f330_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-12_b753ab1d9adb4b3278886f142e88f330_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
67KB

MD5
54395aa573b25b71b1017f1288f019aa

SHA1
9430cc131b8b3f2d17e9d521dee924de8e69440f

SHA256
ad3607d4345c7f429c73166f6daed9b37b55d07a876b85e006e1aaa806eed80c

SHA512
9bb997cb85242b1e9755a97ea7c4c633d0853e5e438afd4cb83d3b45107d37c862828d1252de6a5179e4992ed782b8ad2d6b4fcd864b4e0cd2cc468110c338c8

Download Submit
memory/3268-0-0x00000000022F0000-0x00000000022F6000-memory.dmp

Filesize
24KB

Download
memory/3268-1-0x00000000022F0000-0x00000000022F6000-memory.dmp

Filesize
24KB

Download
memory/3268-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4804-19-0x0000000001F10000-0x0000000001F16000-memory.dmp

Filesize
24KB

Download