82e4d4abd2dc08273db93d8352b183d58eab8b6d8bc24de293b3eba78a764606

Analysis

max time kernel
128s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
15/08/2023, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ff4930043bed0bec49bf40551f4d8455_cryptolocker_JC.exe
Size

60KB
MD5

ff4930043bed0bec49bf40551f4d8455
SHA1

5cc339c01d2500ecfdbca9231af6197f9242cbd1
SHA256

82e4d4abd2dc08273db93d8352b183d58eab8b6d8bc24de293b3eba78a764606
SHA512

319666ff767a3fac58fd717c91ba7fe482cef0c0d746683609bab1f10a018f7c8898f9fdec33812db378964dffc827112fb03e372386efb7d740fc76c97dc6ae
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszsbKY1xo3/nyx6C:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7W

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3080	hurok.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 3080	4664	ff4930043bed0bec49bf40551f4d8455_cryptolocker_JC.exe	82
PID 4664 wrote to memory of 3080	4664	ff4930043bed0bec49bf40551f4d8455_cryptolocker_JC.exe	82
PID 4664 wrote to memory of 3080	4664	ff4930043bed0bec49bf40551f4d8455_cryptolocker_JC.exe	82

C:\Users\Admin\AppData\Local\Temp\ff4930043bed0bec49bf40551f4d8455_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\ff4930043bed0bec49bf40551f4d8455_cryptolocker_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Executes dropped EXE
  PID:3080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
60KB

MD5
0b958838e3b4ce0c6cb157efdafd9256

SHA1
419f29beab11009efc60eb11573a31dfc4e987c2

SHA256
16af63d85234e7d7db4fb5fceecf1881cf3a49c9d49c70e7a7db66c59300a6a3

SHA512
10540d145aa9b2a53a9eafe7aeb0f58de9e8dcfa2f77d8598a2eb6bc8a3259f2205156184fe288f2f2f3a69daf1b2213557e82f7d45c8a561b8d59d4182e598e

Download Submit
C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
60KB

MD5
0b958838e3b4ce0c6cb157efdafd9256

SHA1
419f29beab11009efc60eb11573a31dfc4e987c2

SHA256
16af63d85234e7d7db4fb5fceecf1881cf3a49c9d49c70e7a7db66c59300a6a3

SHA512
10540d145aa9b2a53a9eafe7aeb0f58de9e8dcfa2f77d8598a2eb6bc8a3259f2205156184fe288f2f2f3a69daf1b2213557e82f7d45c8a561b8d59d4182e598e

Download Submit
C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
60KB

MD5
0b958838e3b4ce0c6cb157efdafd9256

SHA1
419f29beab11009efc60eb11573a31dfc4e987c2

SHA256
16af63d85234e7d7db4fb5fceecf1881cf3a49c9d49c70e7a7db66c59300a6a3

SHA512
10540d145aa9b2a53a9eafe7aeb0f58de9e8dcfa2f77d8598a2eb6bc8a3259f2205156184fe288f2f2f3a69daf1b2213557e82f7d45c8a561b8d59d4182e598e

Download Submit
memory/3080-152-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/4664-133-0x00000000006E0000-0x00000000006E6000-memory.dmp

Filesize
24KB

Download
memory/4664-134-0x00000000006E0000-0x00000000006E6000-memory.dmp

Filesize
24KB

Download
memory/4664-135-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download