93193b20c7f58d56d660d34cd0d1f7b9d3fe5c367ce73820dc0c483bd3f4d760

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-01-2024 00:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-24_de97d6686efec8eb8cb074f56bc65d13_cryptolocker.exe
Size

44KB
MD5

de97d6686efec8eb8cb074f56bc65d13
SHA1

a7c2ccc2c3ef123a916ce4099b82dbedd07e2834
SHA256

93193b20c7f58d56d660d34cd0d1f7b9d3fe5c367ce73820dc0c483bd3f4d760
SHA512

00777b1f3a0ea895c73e16b6134abd9dab3083c3dcdc894f4ae2744238e281cadb56af08f9710be17a47a7011bd56afd678fa3c80c81126783deaf39d4395db4
SSDEEP

768:Kf1K2exg2kBwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZsBGGpebVIYLHA3Kx3:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XC

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c000000012262-22.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000c000000012262-22.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2720	hurok.exe

Loads dropped DLL 1 IoCs

pid	Process
2452	2024-01-24_de97d6686efec8eb8cb074f56bc65d13_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2452	2024-01-24_de97d6686efec8eb8cb074f56bc65d13_cryptolocker.exe
2720	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 2720	2452	2024-01-24_de97d6686efec8eb8cb074f56bc65d13_cryptolocker.exe	1
PID 2452 wrote to memory of 2720	2452	2024-01-24_de97d6686efec8eb8cb074f56bc65d13_cryptolocker.exe	1
PID 2452 wrote to memory of 2720	2452	2024-01-24_de97d6686efec8eb8cb074f56bc65d13_cryptolocker.exe	1
PID 2452 wrote to memory of 2720	2452	2024-01-24_de97d6686efec8eb8cb074f56bc65d13_cryptolocker.exe	1

C:\Users\Admin\AppData\Local\Temp\hurok.exe
"C:\Users\Admin\AppData\Local\Temp\hurok.exe"
1⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2720

C:\Users\Admin\AppData\Local\Temp\2024-01-24_de97d6686efec8eb8cb074f56bc65d13_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-24_de97d6686efec8eb8cb074f56bc65d13_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
44KB

MD5
9472d26d3251c90038f9ff208043dc04

SHA1
cb94d29de73da38e8d4f2c45c971f82aea1ad9d8

SHA256
385ba68f2bee70ff408769567aae03dfac5d9dc16cbcc8a4ad37515bb1a4e30d

SHA512
32b24965a261f7f2cca850922c8f058781dee67a7ad53acc627af6fb500bc6e3278ec82e1206fafcdc8e9746ebc873035233cb948a618fbb8761c1f8e5255caf

Download Submit
memory/2452-3-0x00000000003B0000-0x00000000003B6000-memory.dmp

Filesize
24KB

Download
memory/2452-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2452-0-0x00000000003B0000-0x00000000003B6000-memory.dmp

Filesize
24KB

Download