cf7def47845c3708036e18e03ebb51c12d74995a7cc331077dfe948a35a55586

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 09:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-01-25_d3b292de78d3c88dfd6ed4d166f08a36_cryptolocker.exe
Size

61KB
MD5

d3b292de78d3c88dfd6ed4d166f08a36
SHA1

fae93f6b3ae83281c739362a811adce1d8951d16
SHA256

cf7def47845c3708036e18e03ebb51c12d74995a7cc331077dfe948a35a55586
SHA512

bc003e93120bcd701d7f6f7d8a0f422accad8e7aa945ba617806526d5a72fa60eec82f8f35761d6b2dd36ad456a3a0c48a42d359acdea508c85e048264a4214e
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszudnYTjipvF299w:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7o

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b00000001225f-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000b00000001225f-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
1976	hurok.exe

Loads dropped DLL 1 IoCs

pid	Process
2104	2024-01-25_d3b292de78d3c88dfd6ed4d166f08a36_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2104	2024-01-25_d3b292de78d3c88dfd6ed4d166f08a36_cryptolocker.exe
1976	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 1976	2104	2024-01-25_d3b292de78d3c88dfd6ed4d166f08a36_cryptolocker.exe	28
PID 2104 wrote to memory of 1976	2104	2024-01-25_d3b292de78d3c88dfd6ed4d166f08a36_cryptolocker.exe	28
PID 2104 wrote to memory of 1976	2104	2024-01-25_d3b292de78d3c88dfd6ed4d166f08a36_cryptolocker.exe	28
PID 2104 wrote to memory of 1976	2104	2024-01-25_d3b292de78d3c88dfd6ed4d166f08a36_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-25_d3b292de78d3c88dfd6ed4d166f08a36_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_d3b292de78d3c88dfd6ed4d166f08a36_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
62KB

MD5
d30abd1bca3038959dbb823bae592032

SHA1
af072e7f1b0549ed220033790f9fd50b808b7744

SHA256
2fe999c146f7aae2d611e4d8d9075692602161c38c159f2f3cb7bba1433ea69f

SHA512
b81e840ef9236e798706b5c814d3438f054be6a465cae033c1061f34893cb395715a17528ee8b41bd7b2266d4f351047ef9b3229070700de796f768ffc0e2156

Download Submit
memory/1976-17-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/2104-0-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2104-1-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2104-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download