Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    24/01/2024, 20:22

General

  • Target

    2024-01-24_163e72755be7a9201537b6407fe05460_cryptolocker.exe

  • Size

    61KB

  • MD5

    163e72755be7a9201537b6407fe05460

  • SHA1

    1a3998e792cebbd5467182d53686f5916b2f1fb1

  • SHA256

    b91e25cae10429256e1b25a2990db4401a93d7b7a25201b6a95385410793e29f

  • SHA512

    a855026dcd3a9d2637a66102f2c357ac1fdca64376cd062eeb4bc6c81804b719ec5a8e3b42a81811db8f13894661118279639aaaeb72a3b916a82950f15fcf6d

  • SSDEEP

    1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszudnYTjipvF299S:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7K

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-01-24_163e72755be7a9201537b6407fe05460_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-24_163e72755be7a9201537b6407fe05460_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1992
    • C:\Users\Admin\AppData\Local\Temp\hurok.exe
      "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2384

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\hurok.exe

    Filesize

    61KB

    MD5

    f6890c70dadd541aca06f394af0205d6

    SHA1

    f10a67c0c0320b81d8546d6761ad6f1f4be75ee3

    SHA256

    bd2ddb5fe45da9a636b2f71394728c6d5a9f8f878b1fd057d20a82072f563b89

    SHA512

    60a075d05ac8b4a07e3da18fb495135ac1882448d43111f669e33524545d87ab22a28495fa230ddd7960d308ab459e2fd5a4d7d86d5f3e4c7e1290944cd31f20

  • memory/1992-0-0x00000000002B0000-0x00000000002B6000-memory.dmp

    Filesize

    24KB

  • memory/1992-1-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/1992-7-0x00000000002B0000-0x00000000002B6000-memory.dmp

    Filesize

    24KB

  • memory/2384-16-0x00000000001C0000-0x00000000001C6000-memory.dmp

    Filesize

    24KB