fd9fed9c2833ad7c63331a05092447c3fb6d16d0dd8fda5b4502c13ac277fec6

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2024 11:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-13_53d5b3363c22c8e1f8b8a6d827809ecd_cryptolocker.exe
Size

43KB
MD5

53d5b3363c22c8e1f8b8a6d827809ecd
SHA1

a31823502178ec2a3cc27175b0859197b442b06c
SHA256

fd9fed9c2833ad7c63331a05092447c3fb6d16d0dd8fda5b4502c13ac277fec6
SHA512

495b780b0b6536c4b0f5b8790e0ca099d8c77f6ddcc014b0ec7c36e55c2f331e370c1ba3cb122fff41e59e3d01161caacc72f7d97be810eb2f8c31a882bc7d99
SSDEEP

768:Kf1K2exg2kBwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZsBGGpebVIYLHA3Kx1:o1KhxqwtdgI2MyzNORQtOflIwoHNV2X8

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	2024-10-13_53d5b3363c22c8e1f8b8a6d827809ecd_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	hurok.exe

Executes dropped EXE 1 IoCs

pid	Process
1836	hurok.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-13_53d5b3363c22c8e1f8b8a6d827809ecd_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hurok.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3108 wrote to memory of 1836	3108	2024-10-13_53d5b3363c22c8e1f8b8a6d827809ecd_cryptolocker.exe	84
PID 3108 wrote to memory of 1836	3108	2024-10-13_53d5b3363c22c8e1f8b8a6d827809ecd_cryptolocker.exe	84
PID 3108 wrote to memory of 1836	3108	2024-10-13_53d5b3363c22c8e1f8b8a6d827809ecd_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-10-13_53d5b3363c22c8e1f8b8a6d827809ecd_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-13_53d5b3363c22c8e1f8b8a6d827809ecd_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
43KB

MD5
c8bb0ef8401f2fbdc6deefa41cdb2ce6

SHA1
f676d87b618da571bc2dbb734c98c2854752f3f9

SHA256
5f534a9080cee5e3ac76483ca393afe8be589570ef7f37725b99826833d18de6

SHA512
fdc64972cbeb92a0ab86460b3d077ebb7afc1addc7824fd675004eb89c865053527e39e1302395591a4ac67e4aa668579f24c39f9cfe4e920be4ef1c1fe7c020

Download Submit
memory/1836-19-0x0000000002040000-0x0000000002046000-memory.dmp

Filesize
24KB

Download
memory/3108-0-0x00000000005F0000-0x00000000005F6000-memory.dmp

Filesize
24KB

Download
memory/3108-1-0x00000000005F0000-0x00000000005F6000-memory.dmp

Filesize
24KB

Download
memory/3108-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download