e13804042136c28e016e70dde69966a29f3344c3c540999712b457664ee0486e

Analysis

max time kernel
143s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 05:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-10_f54e263ef0ff6c376768249fe95952b5_cryptolocker.exe
Size

62KB
MD5

f54e263ef0ff6c376768249fe95952b5
SHA1

4deec1fadfef6270f1f5469ba0320d79a936b1e0
SHA256

e13804042136c28e016e70dde69966a29f3344c3c540999712b457664ee0486e
SHA512

dd0f6ec15561fc73e37be17a887ec6c1edf1ba2e4a4e4858d4ee56a54079c8a390c876bc849e8e6acb6c157aa3fbc6b7d1d37578ccddbdfb3de8d8c26e84d7b8
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszsbKY1x/9lfL+gniDSaOs:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7X

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2800	hurok.exe

Loads dropped DLL 1 IoCs

pid	Process
1708	2024-01-10_f54e263ef0ff6c376768249fe95952b5_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1708	2024-01-10_f54e263ef0ff6c376768249fe95952b5_cryptolocker.exe
2800	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2800	1708	2024-01-10_f54e263ef0ff6c376768249fe95952b5_cryptolocker.exe	14
PID 1708 wrote to memory of 2800	1708	2024-01-10_f54e263ef0ff6c376768249fe95952b5_cryptolocker.exe	14
PID 1708 wrote to memory of 2800	1708	2024-01-10_f54e263ef0ff6c376768249fe95952b5_cryptolocker.exe	14
PID 1708 wrote to memory of 2800	1708	2024-01-10_f54e263ef0ff6c376768249fe95952b5_cryptolocker.exe	14

C:\Users\Admin\AppData\Local\Temp\hurok.exe
"C:\Users\Admin\AppData\Local\Temp\hurok.exe"
1⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2800

C:\Users\Admin\AppData\Local\Temp\2024-01-10_f54e263ef0ff6c376768249fe95952b5_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-10_f54e263ef0ff6c376768249fe95952b5_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
63KB

MD5
bec81e66dd4783ab3082619eaba79dbc

SHA1
2323f50d248f39f5574eb35a3c9227d6da2baf28

SHA256
0f73b24751fec75b06d401d1dd3a285cc6b40e757204eed99af8aa27e34e80d4

SHA512
eaf1ab4f2816170f8b064614f7fca20d0affeb2761319a554b9a1a6c03471204bcd1fdaaa4bfc72041f430f3898237dca753e9a2dc4265740c2ecf2da1f3d25e

Download Submit
memory/1708-8-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/1708-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1708-0-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/2800-23-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download