e7e165b9d8e1ec04ad88bcec06473a3d8d70c02ac80e7fe1f84f2eff4c0c0a60

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
02/10/2023, 17:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2023-08-27_3a07f40d453cc88278facc278f52f17d_cryptolocker_JC.exe
Size

59KB
MD5

3a07f40d453cc88278facc278f52f17d
SHA1

6794a86cd0f0165da66cc841b871339b4b4b2e70
SHA256

e7e165b9d8e1ec04ad88bcec06473a3d8d70c02ac80e7fe1f84f2eff4c0c0a60
SHA512

7afb7d27975d6ee5dfb8801272cda5ce56cd42c693698fcdffb292533ae9f15905cc93116e84c5ac4eecfbff68bcbcb3e392abdf7e2d80296a598a6c8c9ef0bd
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszudnYTjipvF29/:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7N

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2716	hurok.exe

Loads dropped DLL 1 IoCs

pid	Process
2748	2023-08-27_3a07f40d453cc88278facc278f52f17d_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2748	2023-08-27_3a07f40d453cc88278facc278f52f17d_cryptolocker_JC.exe
2716	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2716	2748	2023-08-27_3a07f40d453cc88278facc278f52f17d_cryptolocker_JC.exe	28
PID 2748 wrote to memory of 2716	2748	2023-08-27_3a07f40d453cc88278facc278f52f17d_cryptolocker_JC.exe	28
PID 2748 wrote to memory of 2716	2748	2023-08-27_3a07f40d453cc88278facc278f52f17d_cryptolocker_JC.exe	28
PID 2748 wrote to memory of 2716	2748	2023-08-27_3a07f40d453cc88278facc278f52f17d_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\2023-08-27_3a07f40d453cc88278facc278f52f17d_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\2023-08-27_3a07f40d453cc88278facc278f52f17d_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
60KB

MD5
6fda574d10c75cf0d4552fa0797f5ba0

SHA1
237254b892e937f7ca9ccf9c742739f25447f89c

SHA256
bfd40cc107f405d4326e0db0490e2e0664b05dbde5950e70d940a891de9cf5bc

SHA512
929a83274350e5e8c5f528e7de54d01126c1fff3e75684b3604a72e05aef07645884212437feb6011e06d5922244cccb717756b347da8fbf07e73a9595292627

Download Submit
C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
60KB

MD5
6fda574d10c75cf0d4552fa0797f5ba0

SHA1
237254b892e937f7ca9ccf9c742739f25447f89c

SHA256
bfd40cc107f405d4326e0db0490e2e0664b05dbde5950e70d940a891de9cf5bc

SHA512
929a83274350e5e8c5f528e7de54d01126c1fff3e75684b3604a72e05aef07645884212437feb6011e06d5922244cccb717756b347da8fbf07e73a9595292627

Download Submit
\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
60KB

MD5
6fda574d10c75cf0d4552fa0797f5ba0

SHA1
237254b892e937f7ca9ccf9c742739f25447f89c

SHA256
bfd40cc107f405d4326e0db0490e2e0664b05dbde5950e70d940a891de9cf5bc

SHA512
929a83274350e5e8c5f528e7de54d01126c1fff3e75684b3604a72e05aef07645884212437feb6011e06d5922244cccb717756b347da8fbf07e73a9595292627

Download Submit
memory/2716-16-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/2748-0-0x00000000003D0000-0x00000000003D6000-memory.dmp

Filesize
24KB

Download
memory/2748-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2748-2-0x00000000003D0000-0x00000000003D6000-memory.dmp

Filesize
24KB

Download