30823871cb6cde69b4d9a2c727036aa0cac028ac779ee7c1659bf3720508ba87

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
31/10/2023, 16:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.2023-09-08_e1039fd9736558b1318c803c46c49ec4_cryptolocker_JC.exe
Size

60KB
MD5

e1039fd9736558b1318c803c46c49ec4
SHA1

6ff8a481f00b4af3e67ee7d4f3b843a2ca96cc1d
SHA256

30823871cb6cde69b4d9a2c727036aa0cac028ac779ee7c1659bf3720508ba87
SHA512

5fe147e9afda52ddc122974884f96eefd66eff565c58fc830bbc85a585d4b8304ff5b0530c38c5ec5a4253fb3a563f98ca42effc470a62ff525368a5634f0cbd
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszsbKY1x/9lfL+gniDSY:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7R

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2636	hurok.exe

Loads dropped DLL 1 IoCs

pid	Process
2280	NEAS.2023-09-08_e1039fd9736558b1318c803c46c49ec4_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2280	NEAS.2023-09-08_e1039fd9736558b1318c803c46c49ec4_cryptolocker_JC.exe
2636	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2636	2280	NEAS.2023-09-08_e1039fd9736558b1318c803c46c49ec4_cryptolocker_JC.exe	28
PID 2280 wrote to memory of 2636	2280	NEAS.2023-09-08_e1039fd9736558b1318c803c46c49ec4_cryptolocker_JC.exe	28
PID 2280 wrote to memory of 2636	2280	NEAS.2023-09-08_e1039fd9736558b1318c803c46c49ec4_cryptolocker_JC.exe	28
PID 2280 wrote to memory of 2636	2280	NEAS.2023-09-08_e1039fd9736558b1318c803c46c49ec4_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-08_e1039fd9736558b1318c803c46c49ec4_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-08_e1039fd9736558b1318c803c46c49ec4_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
60KB

MD5
efbfc09d84da407768aa21fc40bf9df8

SHA1
d6cd5b6d5ee88aaad2e51e319d7777b487218e15

SHA256
e8ef16c9d7b8742b92f39831366875c58fbe22b8fc5b652d5403f51f18a703e0

SHA512
72cd474d93788b28a89825ae3d4ad4daaea0748f95ee1f3830bfe0c5370e799560d7549686e2d26762d3c4f426661964d8ea0bc1c5c00741951d4373c35f7624

Download Submit
C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
60KB

MD5
efbfc09d84da407768aa21fc40bf9df8

SHA1
d6cd5b6d5ee88aaad2e51e319d7777b487218e15

SHA256
e8ef16c9d7b8742b92f39831366875c58fbe22b8fc5b652d5403f51f18a703e0

SHA512
72cd474d93788b28a89825ae3d4ad4daaea0748f95ee1f3830bfe0c5370e799560d7549686e2d26762d3c4f426661964d8ea0bc1c5c00741951d4373c35f7624

Download Submit
\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
60KB

MD5
efbfc09d84da407768aa21fc40bf9df8

SHA1
d6cd5b6d5ee88aaad2e51e319d7777b487218e15

SHA256
e8ef16c9d7b8742b92f39831366875c58fbe22b8fc5b652d5403f51f18a703e0

SHA512
72cd474d93788b28a89825ae3d4ad4daaea0748f95ee1f3830bfe0c5370e799560d7549686e2d26762d3c4f426661964d8ea0bc1c5c00741951d4373c35f7624

Download Submit
memory/2280-0-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/2280-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2280-1-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download