0d7364b277375a754d304d31f0b25a865c6d36d6854e7f26b4db8ba688a4661f

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27-01-2024 13:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-27_07f2910d6d472d10f8ddbcef06144f77_cryptolocker.exe
Size

34KB
MD5

07f2910d6d472d10f8ddbcef06144f77
SHA1

9c76a27c701469cc7f4aff4f050d2b54b78f5857
SHA256

0d7364b277375a754d304d31f0b25a865c6d36d6854e7f26b4db8ba688a4661f
SHA512

fa6620b8635099286c6667c6f702d2d40bcf6c5d7d5a52d32059cad69b44fc11ce992cba2c438b4936c6e34d8df06b90b665e7734fcc860c3db217bb10a34725
SSDEEP

768:Kf1K2exg2kBwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZsBGGp/YIm7wm//:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XE

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000012243-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000012243-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
3048	hurok.exe

Loads dropped DLL 1 IoCs

pid	Process
2276	2024-01-27_07f2910d6d472d10f8ddbcef06144f77_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2276	2024-01-27_07f2910d6d472d10f8ddbcef06144f77_cryptolocker.exe
3048	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 3048	2276	2024-01-27_07f2910d6d472d10f8ddbcef06144f77_cryptolocker.exe	28
PID 2276 wrote to memory of 3048	2276	2024-01-27_07f2910d6d472d10f8ddbcef06144f77_cryptolocker.exe	28
PID 2276 wrote to memory of 3048	2276	2024-01-27_07f2910d6d472d10f8ddbcef06144f77_cryptolocker.exe	28
PID 2276 wrote to memory of 3048	2276	2024-01-27_07f2910d6d472d10f8ddbcef06144f77_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-27_07f2910d6d472d10f8ddbcef06144f77_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-27_07f2910d6d472d10f8ddbcef06144f77_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
34KB

MD5
25b3f912328b033475d5b28ec19b7ce3

SHA1
2603d1f0ddc65c9636340a4731a0bbf23e09b0c1

SHA256
3ce6ffcb4b16b0504f4f03e49305d5338438705b66ba049064b3033e05869353

SHA512
0f9c3b515296be5c28748ac051578ddf78b65c1a18debd59b671cf10849c450d473b691ed51b7235073960a6750b89fe722943e62dd139b11069817a2cd6707d

Download Submit
memory/2276-0-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/2276-2-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/2276-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3048-17-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download