e1431be4ece9d78be0164476db03079b0cfb71413889509f8d7cf366d1f25722

Analysis

max time kernel
94s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 07:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-21_17db13875713a531b2b8e16fe6fc36ca_cryptolocker.exe
Size

69KB
MD5

17db13875713a531b2b8e16fe6fc36ca
SHA1

0764fe69eeb93b74d78b308627cc554b64bc6d38
SHA256

e1431be4ece9d78be0164476db03079b0cfb71413889509f8d7cf366d1f25722
SHA512

191a035a9b99bda987e5628cb3f49194dc2d5552f14d77a85ff5aaa94f7620d79b06ca6ee140b2eae4ed25f929bbfb6ffde3cff9be392401ad0b5e22af9d6577
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszudnYTjipvF293vaRLEr:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7z

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	2024-11-21_17db13875713a531b2b8e16fe6fc36ca_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	hurok.exe

Executes dropped EXE 1 IoCs

pid	Process
2848	hurok.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-21_17db13875713a531b2b8e16fe6fc36ca_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hurok.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 2848	2604	2024-11-21_17db13875713a531b2b8e16fe6fc36ca_cryptolocker.exe	82
PID 2604 wrote to memory of 2848	2604	2024-11-21_17db13875713a531b2b8e16fe6fc36ca_cryptolocker.exe	82
PID 2604 wrote to memory of 2848	2604	2024-11-21_17db13875713a531b2b8e16fe6fc36ca_cryptolocker.exe	82

C:\Users\Admin\AppData\Local\Temp\2024-11-21_17db13875713a531b2b8e16fe6fc36ca_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-21_17db13875713a531b2b8e16fe6fc36ca_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
69KB

MD5
7a1fe6ba1271929a4e3c8f909b40b314

SHA1
e7e3b0f43a74c3abac026a0ed7b5dcf8c34fe73a

SHA256
16ca498c35c54f5a834ed0fa692182b3f039e65d866877ab05da1bd555f2ab64

SHA512
aa4bf048b3c858081f974dc0b653822eaa31a6511249a03a9d053b0654a17becb9396dcb21a52847f657860213bfc960afe634cca4838a3b4697dbedfb006e9e

Download Submit
memory/2604-0-0x00000000006E0000-0x00000000006E6000-memory.dmp

Filesize
24KB

Download
memory/2604-1-0x00000000006E0000-0x00000000006E6000-memory.dmp

Filesize
24KB

Download
memory/2604-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2848-19-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download