c981bcb5dd03b7c28a63f36afd2c63769450e4cd9a7e1b4b97ee4592e4f75b24

Analysis

max time kernel
94s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2024, 04:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-21_be2d55ca3bc4db61b76e0955525b37e2_cryptolocker.exe
Size

48KB
MD5

be2d55ca3bc4db61b76e0955525b37e2
SHA1

638b9b90412eb936752304fe9ead8c7e86462b48
SHA256

c981bcb5dd03b7c28a63f36afd2c63769450e4cd9a7e1b4b97ee4592e4f75b24
SHA512

7496d4c4c0985d3feaad86ffa53b91c5d1d940924e63be6d30f26b955c532c1c409b2094eebce412ef3af91c349a8dc365bbadb7248e3061ed6a3ab64933feb8
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszsbKY1x5hjatZ:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7t

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	2024-11-21_be2d55ca3bc4db61b76e0955525b37e2_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	hurok.exe

Executes dropped EXE 1 IoCs

pid	Process
3956	hurok.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-21_be2d55ca3bc4db61b76e0955525b37e2_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hurok.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 3956	4740	2024-11-21_be2d55ca3bc4db61b76e0955525b37e2_cryptolocker.exe	82
PID 4740 wrote to memory of 3956	4740	2024-11-21_be2d55ca3bc4db61b76e0955525b37e2_cryptolocker.exe	82
PID 4740 wrote to memory of 3956	4740	2024-11-21_be2d55ca3bc4db61b76e0955525b37e2_cryptolocker.exe	82

C:\Users\Admin\AppData\Local\Temp\2024-11-21_be2d55ca3bc4db61b76e0955525b37e2_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-21_be2d55ca3bc4db61b76e0955525b37e2_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
49KB

MD5
13fd0dc7fa7b274b46d4b4d376a3e4d6

SHA1
c48f8350ffe07b868aa1f3407246e06114954c4b

SHA256
2d3416e0835a223cebd783555e6921f7e622c372317473e1798f66c40abd5617

SHA512
f422d6197391080ede9b3fdbf19b7d06c5d7acd3ab22a81f9a5e28a045f5ec836a56cd6530b93fe5184874b3bfa6eb6bfdbab8fb02457fe6c814507b32c75f56

Download Submit
memory/3956-22-0x00000000004B0000-0x00000000004B6000-memory.dmp

Filesize
24KB

Download
memory/4740-0-0x00000000021B0000-0x00000000021B6000-memory.dmp

Filesize
24KB

Download
memory/4740-1-0x00000000021B0000-0x00000000021B6000-memory.dmp

Filesize
24KB

Download
memory/4740-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download