dcb561d346b24655cc34ff80ca1ea3ee7fe744c5d82ee35e6c81d5e85fbb34d2

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
19-08-2023 12:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ed70d444c595036c859bffe7711de97_cryptolocker_JC.exe
Size

38KB
MD5

3ed70d444c595036c859bffe7711de97
SHA1

a46792cd8db7a7d908bdf9390272723ab38019e1
SHA256

dcb561d346b24655cc34ff80ca1ea3ee7fe744c5d82ee35e6c81d5e85fbb34d2
SHA512

eeacb0f9dbece296c8f744fb42ac7a62c545d4b5c675e70578142877c153b45a17b99900a4e2fb16243913a2a12e714743cc1747effc9a479261ef085f510818
SSDEEP

768:Kf1K2exg2kBwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZsBGGpebVIYLHA3Kxy:o1KhxqwtdgI2MyzNORQtOflIwoHNV2Xv

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2944	hurok.exe

Loads dropped DLL 1 IoCs

pid	Process
2132	3ed70d444c595036c859bffe7711de97_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2132	3ed70d444c595036c859bffe7711de97_cryptolocker_JC.exe
2944	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2944	2132	3ed70d444c595036c859bffe7711de97_cryptolocker_JC.exe	28
PID 2132 wrote to memory of 2944	2132	3ed70d444c595036c859bffe7711de97_cryptolocker_JC.exe	28
PID 2132 wrote to memory of 2944	2132	3ed70d444c595036c859bffe7711de97_cryptolocker_JC.exe	28
PID 2132 wrote to memory of 2944	2132	3ed70d444c595036c859bffe7711de97_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\3ed70d444c595036c859bffe7711de97_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\3ed70d444c595036c859bffe7711de97_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
38KB

MD5
d1476aff00e2dc65ce32b3bdad25bcca

SHA1
b83447aabbfd5ad6efa7d75b94a028650850fea2

SHA256
b21b45001b88cea85137fad57d465cf3feacf45fb9d6383638d3166bf65b47fc

SHA512
a220bf9d7c20755cac74fc6b9a3405d50b1f9392ffa8cd64c9ba1e4071af315c79414b3fbd3461aa19c3ade6559611dae8510cc2f060e9eaff3493ee5b5e332d

Download Submit
C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
38KB

MD5
d1476aff00e2dc65ce32b3bdad25bcca

SHA1
b83447aabbfd5ad6efa7d75b94a028650850fea2

SHA256
b21b45001b88cea85137fad57d465cf3feacf45fb9d6383638d3166bf65b47fc

SHA512
a220bf9d7c20755cac74fc6b9a3405d50b1f9392ffa8cd64c9ba1e4071af315c79414b3fbd3461aa19c3ade6559611dae8510cc2f060e9eaff3493ee5b5e332d

Download Submit
\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
38KB

MD5
d1476aff00e2dc65ce32b3bdad25bcca

SHA1
b83447aabbfd5ad6efa7d75b94a028650850fea2

SHA256
b21b45001b88cea85137fad57d465cf3feacf45fb9d6383638d3166bf65b47fc

SHA512
a220bf9d7c20755cac74fc6b9a3405d50b1f9392ffa8cd64c9ba1e4071af315c79414b3fbd3461aa19c3ade6559611dae8510cc2f060e9eaff3493ee5b5e332d

Download Submit
memory/2132-54-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2132-55-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2132-56-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2944-70-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download