30823871cb6cde69b4d9a2c727036aa0cac028ac779ee7c1659bf3720508ba87 | Triage

Analysis

max time kernel
2s
max time network
29s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
31/10/2023, 16:01

Sharing

Report Analysis Logs

General

Target

NEAS.2023-09-08_e1039fd9736558b1318c803c46c49ec4_cryptolocker_JC.exe
Size

60KB
MD5

e1039fd9736558b1318c803c46c49ec4
SHA1

6ff8a481f00b4af3e67ee7d4f3b843a2ca96cc1d
SHA256

30823871cb6cde69b4d9a2c727036aa0cac028ac779ee7c1659bf3720508ba87
SHA512

5fe147e9afda52ddc122974884f96eefd66eff565c58fc830bbc85a585d4b8304ff5b0530c38c5ec5a4253fb3a563f98ca42effc470a62ff525368a5634f0cbd
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszsbKY1x/9lfL+gniDSY:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7R

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-08_e1039fd9736558b1318c803c46c49ec4_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-08_e1039fd9736558b1318c803c46c49ec4_cryptolocker_JC.exe"
1⤵
PID:4528
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  PID:4244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
60KB

MD5
efbfc09d84da407768aa21fc40bf9df8

SHA1
d6cd5b6d5ee88aaad2e51e319d7777b487218e15

SHA256
e8ef16c9d7b8742b92f39831366875c58fbe22b8fc5b652d5403f51f18a703e0

SHA512
72cd474d93788b28a89825ae3d4ad4daaea0748f95ee1f3830bfe0c5370e799560d7549686e2d26762d3c4f426661964d8ea0bc1c5c00741951d4373c35f7624

Download Submit
C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
60KB

MD5
efbfc09d84da407768aa21fc40bf9df8

SHA1
d6cd5b6d5ee88aaad2e51e319d7777b487218e15

SHA256
e8ef16c9d7b8742b92f39831366875c58fbe22b8fc5b652d5403f51f18a703e0

SHA512
72cd474d93788b28a89825ae3d4ad4daaea0748f95ee1f3830bfe0c5370e799560d7549686e2d26762d3c4f426661964d8ea0bc1c5c00741951d4373c35f7624

Download Submit
C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
60KB

MD5
efbfc09d84da407768aa21fc40bf9df8

SHA1
d6cd5b6d5ee88aaad2e51e319d7777b487218e15

SHA256
e8ef16c9d7b8742b92f39831366875c58fbe22b8fc5b652d5403f51f18a703e0

SHA512
72cd474d93788b28a89825ae3d4ad4daaea0748f95ee1f3830bfe0c5370e799560d7549686e2d26762d3c4f426661964d8ea0bc1c5c00741951d4373c35f7624

Download Submit
memory/4528-0-0x0000000002180000-0x0000000002186000-memory.dmp

Filesize
24KB

Download
memory/4528-1-0x0000000002180000-0x0000000002186000-memory.dmp

Filesize
24KB

Download
memory/4528-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download