fb7e189dd3954f10a0e20047fa56e919b1290e8aaf72076370fa7f0ddf0cb3fa

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
17-02-2024 12:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-17_168f4f7489cabbbba74adf50f395cc7b_cryptolocker.exe
Size

35KB
MD5

168f4f7489cabbbba74adf50f395cc7b
SHA1

0938820878e3e57cd7a3644b7645c82ea1e08f36
SHA256

fb7e189dd3954f10a0e20047fa56e919b1290e8aaf72076370fa7f0ddf0cb3fa
SHA512

e683170e67d7c589bf203ed87759ddcfb4716d3b1bc7927fff24c0b6e2224d15d0b03c6d8aa9118d3981c511381a86e277e1b73d6caba89ae5c0c14a5e8167dd
SSDEEP

768:Kf1K2exg2kBwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZsBGGp/YIm7wm0j:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XB

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c0000000122d5-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000c0000000122d5-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2692	hurok.exe

Loads dropped DLL 1 IoCs

pid	Process
2528	2024-02-17_168f4f7489cabbbba74adf50f395cc7b_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2528	2024-02-17_168f4f7489cabbbba74adf50f395cc7b_cryptolocker.exe
2692	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2692	2528	2024-02-17_168f4f7489cabbbba74adf50f395cc7b_cryptolocker.exe	28
PID 2528 wrote to memory of 2692	2528	2024-02-17_168f4f7489cabbbba74adf50f395cc7b_cryptolocker.exe	28
PID 2528 wrote to memory of 2692	2528	2024-02-17_168f4f7489cabbbba74adf50f395cc7b_cryptolocker.exe	28
PID 2528 wrote to memory of 2692	2528	2024-02-17_168f4f7489cabbbba74adf50f395cc7b_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-17_168f4f7489cabbbba74adf50f395cc7b_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-17_168f4f7489cabbbba74adf50f395cc7b_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
35KB

MD5
bb2e92b291320edc7b0e779abcbcff0e

SHA1
5937dfbdac61d8a94d0de2716e079ee1050b93e9

SHA256
9a9036fb093cf2a5e7b7f4029e74b5696f748e8d885e45e608b6ac15c070c769

SHA512
9831a3792cbbf1f72d8102f51d684b078029a72af01a5c7c962297498d12c9895057a9703013b372badefb0ce85b74306c7fb6cc670317e8ec4c1a97943a1d1b

Download Submit
memory/2528-0-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2528-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2528-2-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2692-19-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download