06bb7ce395e3fb0b5e6afbfab8949db8cf92f47d2a53803bbca5c806c75ca712

Analysis

max time kernel
94s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 03:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-01_8dd509c41bbb89c89dc538812ff62f6e_cryptolocker.exe
Size

70KB
MD5

8dd509c41bbb89c89dc538812ff62f6e
SHA1

e162e42d51cd0e961ec7ef60455d40535de33e75
SHA256

06bb7ce395e3fb0b5e6afbfab8949db8cf92f47d2a53803bbca5c806c75ca712
SHA512

1930129d062fea72b30db123a8ee05f010a8e4f93a3b4a3ab4af49c401a2c05b9da6fc2eedc2b7aacde212372e028c24d9f5120f0d91d0f4c726b78841cfcb78
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszudnYTjipvF293vaRLE4:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7g

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	2024-10-01_8dd509c41bbb89c89dc538812ff62f6e_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	hurok.exe

Executes dropped EXE 1 IoCs

pid	Process
4356	hurok.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-01_8dd509c41bbb89c89dc538812ff62f6e_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hurok.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 4356	5004	2024-10-01_8dd509c41bbb89c89dc538812ff62f6e_cryptolocker.exe	82
PID 5004 wrote to memory of 4356	5004	2024-10-01_8dd509c41bbb89c89dc538812ff62f6e_cryptolocker.exe	82
PID 5004 wrote to memory of 4356	5004	2024-10-01_8dd509c41bbb89c89dc538812ff62f6e_cryptolocker.exe	82

C:\Users\Admin\AppData\Local\Temp\2024-10-01_8dd509c41bbb89c89dc538812ff62f6e_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-01_8dd509c41bbb89c89dc538812ff62f6e_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
70KB

MD5
7f17492c0ad9a88876c7f01a4a82b067

SHA1
f41cbcdf545c9bb6d7c7c1b54289057fca34da85

SHA256
5c4228f3542d7ff5dbd8c2a73e027133b55ddf554f240714b86734457400202b

SHA512
84e8c1a64e9b4deaae5e02bd36d9dd7977665b84db168eb966591c982b7cd799426e70475d4512c32b6e4608018790b41ba21faa07bad324a2bb086147af5d65

Download Submit
memory/4356-25-0x00000000021C0000-0x00000000021C6000-memory.dmp

Filesize
24KB

Download
memory/5004-0-0x0000000000590000-0x0000000000596000-memory.dmp

Filesize
24KB

Download
memory/5004-1-0x0000000000590000-0x0000000000596000-memory.dmp

Filesize
24KB

Download
memory/5004-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download