f1c1c50554df671149df76cc43d022577649d5db4f2a131b84c6c76915b9e76f

Analysis

max time kernel
152s
max time network
173s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 06:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-11_e9cc26cc4866cfb2c1387df28b47e0d7_cryptolocker.exe
Size

60KB
MD5

e9cc26cc4866cfb2c1387df28b47e0d7
SHA1

7548042071dd7587b3914d6a344ffc3bf41684f7
SHA256

f1c1c50554df671149df76cc43d022577649d5db4f2a131b84c6c76915b9e76f
SHA512

b480a4265e7d9a37621ef554da2dd607ba32a2793e609808e55b66fc0232627b68ff66921ae7bd374c03bfc3f9fd18414c88b8552aa608b7853b9fcad37b1daa
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszsbKY1x/9lfL+gniDSAk:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7g

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2232	hurok.exe

Loads dropped DLL 1 IoCs

pid	Process
856	2024-01-11_e9cc26cc4866cfb2c1387df28b47e0d7_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
856	2024-01-11_e9cc26cc4866cfb2c1387df28b47e0d7_cryptolocker.exe
2232	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 2232	856	2024-01-11_e9cc26cc4866cfb2c1387df28b47e0d7_cryptolocker.exe	19
PID 856 wrote to memory of 2232	856	2024-01-11_e9cc26cc4866cfb2c1387df28b47e0d7_cryptolocker.exe	19
PID 856 wrote to memory of 2232	856	2024-01-11_e9cc26cc4866cfb2c1387df28b47e0d7_cryptolocker.exe	19
PID 856 wrote to memory of 2232	856	2024-01-11_e9cc26cc4866cfb2c1387df28b47e0d7_cryptolocker.exe	19

C:\Users\Admin\AppData\Local\Temp\2024-01-11_e9cc26cc4866cfb2c1387df28b47e0d7_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-11_e9cc26cc4866cfb2c1387df28b47e0d7_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:856
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
60KB

MD5
da06265224ebbf034df9e3fc513574f8

SHA1
6b95ee3dae204af69b6e59e26542b7213965b032

SHA256
98a6bc15e68da59822bed5c7878aa231a552dbf1a3bbfe15e22f3680080aeedd

SHA512
b8ae76d7453ec32330831145ad82389170940aead207e4752c409ab5a04894427e867af65dd066f27e088cca61a693b6ab3a622a26b9939de0efb33ea055b472

Download Submit
C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
45KB

MD5
1d96455bc84c49160bb7a9d33d302040

SHA1
e13b242a9b6061f67cabd16b2e01c59a71a8543a

SHA256
7181ee516902cb075eab14f9fc3fd7d4e57c14654249663ae7ec1c9503e73e17

SHA512
90ba0294fd9305f54d773f05d7037ea7e2cffd0c19c31c2aee4201204ecafd95c90b5b190d3947dfa20dc92a6840d4ee4b5367f03b8dab6afeb075001ee67c2b

Download Submit
\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
58KB

MD5
0ba3b186a47c27a37b69975a174d5add

SHA1
ba8da966c232989967f2d7182e8782b838665e7e

SHA256
15f3609247d9c8dce0c272a9c25218a24ae038ff136882dcba253f27f8b4fe45

SHA512
127e97dcf001c108303b04c054bc75f44b9073b78bfda2d140a5f00c31f02e6af524b2af60e910a1c14e0bd42c8bad747d27c520cf7f205b11426cd324d54c0d

Download Submit
memory/856-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/856-3-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/856-0-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download