743b6028bb3b36493fcbf349685156d2a88a86d03008940908bdf606ab64c980

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 06:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-09_4c2dca53dcb8d68dac6a5a9c771c9622_cryptolocker.exe
Size

48KB
MD5

4c2dca53dcb8d68dac6a5a9c771c9622
SHA1

e97659c66c89c1955193f9de8594388b53a8c3b7
SHA256

743b6028bb3b36493fcbf349685156d2a88a86d03008940908bdf606ab64c980
SHA512

3bdde099a734f0bb84472f2f2d45e8415bf1819ca31210f694a7e521cc344dd19a9c697c228fdc04c6dac7cfbe951737f73cb3b32642f08411d89901b0d9fe29
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszsbKY1x5hjatH:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7z

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	hurok.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	2024-10-09_4c2dca53dcb8d68dac6a5a9c771c9622_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3112	hurok.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-09_4c2dca53dcb8d68dac6a5a9c771c9622_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hurok.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3604 wrote to memory of 3112	3604	2024-10-09_4c2dca53dcb8d68dac6a5a9c771c9622_cryptolocker.exe	86
PID 3604 wrote to memory of 3112	3604	2024-10-09_4c2dca53dcb8d68dac6a5a9c771c9622_cryptolocker.exe	86
PID 3604 wrote to memory of 3112	3604	2024-10-09_4c2dca53dcb8d68dac6a5a9c771c9622_cryptolocker.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-10-09_4c2dca53dcb8d68dac6a5a9c771c9622_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-09_4c2dca53dcb8d68dac6a5a9c771c9622_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3604
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
48KB

MD5
cb157d43479464207113ad82d85ed398

SHA1
b45ae0f6c115c47c692e97ed012c25c814287a0e

SHA256
1c00c6fc80e739c7f5ef6b1568f7a921592e57bd90ca23de804e1d6bff9bdf9d

SHA512
dae08e45a779aba6dc3297aa680f573673095396293257a01084ca8634a2c026d534e4ad1dd081cc54e3cdfe41e34bb816a044e68062314cb6d719536e4f48cf

Download Submit
memory/3112-25-0x0000000002040000-0x0000000002046000-memory.dmp

Filesize
24KB

Download
memory/3604-0-0x00000000005D0000-0x00000000005D6000-memory.dmp

Filesize
24KB

Download
memory/3604-1-0x00000000005D0000-0x00000000005D6000-memory.dmp

Filesize
24KB

Download
memory/3604-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download