Analysis

  • max time kernel
    94s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/10/2024, 03:55

General

  • Target

    2024-10-05_e614ef122d325c20a08bd18268137821_cryptolocker.exe

  • Size

    56KB

  • MD5

    e614ef122d325c20a08bd18268137821

  • SHA1

    9025ca0ca08cd831c6a38340d241fe35b947dbb0

  • SHA256

    c1629ed067e8397c3ef37a890888aa35b02fa92fc354725f4c0bdd192ec17dec

  • SHA512

    5b1fcef0fb67dd183b3cdd859b6130921e76708fa196917d2d14f4f37075d95a280e76d515aec7291f3b3c4c4b0e430b38d9afb5fa9adcf77df35125b4506a6f

  • SSDEEP

    1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszsbKY1xzpAIX6EhX:aq7tdgI2MyzNORQtOflIwoHNV2XBFV74

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-05_e614ef122d325c20a08bd18268137821_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-05_e614ef122d325c20a08bd18268137821_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1220
    • C:\Users\Admin\AppData\Local\Temp\hurok.exe
      "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4184

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\hurok.exe

    Filesize

    56KB

    MD5

    9b1e165642dd0cbffa82b6e357870066

    SHA1

    78f38eccb16d9bd76baeb18937311a708468f64f

    SHA256

    9e202b8c10bfa79265d5814ac2e3d37eb7a3bbf44630ed99fbd045aa4deca88d

    SHA512

    1ccd8775a86234de10aa23fbcf4b7461bc50b1f30a4dc549fd3dbf6160a563ef6e9c72f2f913217d393f0917cd932a2ff72b3e564f6dab29fda6fa7703ba4b77

  • memory/1220-0-0x0000000002180000-0x0000000002186000-memory.dmp

    Filesize

    24KB

  • memory/1220-1-0x0000000002180000-0x0000000002186000-memory.dmp

    Filesize

    24KB

  • memory/1220-2-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/4184-19-0x00000000004D0000-0x00000000004D6000-memory.dmp

    Filesize

    24KB