b45d2e6d5ed0714bbd4f7ebf48225672f639bf066beeaeef511dd42947278da5

Analysis

max time kernel
145s
max time network
174s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 05:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-01-11_3a1e8d8b9d4fec94221ac2d3c8ea3055_cryptolocker.exe
Size

40KB
MD5

3a1e8d8b9d4fec94221ac2d3c8ea3055
SHA1

baf3b21a1c821b61354d1d09f26c724c292c5c03
SHA256

b45d2e6d5ed0714bbd4f7ebf48225672f639bf066beeaeef511dd42947278da5
SHA512

f1145c68942feb4eacdff8bc27f9460640234561a83c012d6a192d80d82c5e855c84f32228a686c94c0cac3722d8d038f3f16a819f5665cc747e2eda73044b71
SSDEEP

768:Kf1K2exg2kBwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZsBGGpebVIYLHA3KxR:o1KhxqwtdgI2MyzNORQtOflIwoHNV2Xw

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2796	hurok.exe

Loads dropped DLL 1 IoCs

pid	Process
2992	2024-01-11_3a1e8d8b9d4fec94221ac2d3c8ea3055_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2992	2024-01-11_3a1e8d8b9d4fec94221ac2d3c8ea3055_cryptolocker.exe
2796	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2796	2992	2024-01-11_3a1e8d8b9d4fec94221ac2d3c8ea3055_cryptolocker.exe	28
PID 2992 wrote to memory of 2796	2992	2024-01-11_3a1e8d8b9d4fec94221ac2d3c8ea3055_cryptolocker.exe	28
PID 2992 wrote to memory of 2796	2992	2024-01-11_3a1e8d8b9d4fec94221ac2d3c8ea3055_cryptolocker.exe	28
PID 2992 wrote to memory of 2796	2992	2024-01-11_3a1e8d8b9d4fec94221ac2d3c8ea3055_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-11_3a1e8d8b9d4fec94221ac2d3c8ea3055_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-11_3a1e8d8b9d4fec94221ac2d3c8ea3055_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
40KB

MD5
1951dab822772b5d6e87a1fe7a4f2c19

SHA1
e6f754cd16648c89b7899032ee1e1a499469241b

SHA256
5afcc3f87b76ba8c1435a7020962edc5b5dbbd80f37f7235f22ff7a5f5e554b8

SHA512
b0e799e0b8124c35bbcb2a33bf584d370300d3b399638eab0977a4b8b4e992e41e81effd3eeb89bde758516246dbd5e6e64ab75fbee99944eb416bf07323d868

Download Submit
memory/2992-0-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/2992-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2992-2-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download