8441a5e5b84e7e9efebdef1cf9077c4264843df2470d249fba08bb7913883af1

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/02/2024, 16:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-21_563e5961ff9da4697296ddeabec0441f_cryptolocker.exe
Size

45KB
MD5

563e5961ff9da4697296ddeabec0441f
SHA1

67deba544548ce6c27b6650c3389b393b75508a9
SHA256

8441a5e5b84e7e9efebdef1cf9077c4264843df2470d249fba08bb7913883af1
SHA512

8406301e3432cf368bbc4101d677e861dda1264825834c1983c048fa3babc95a0011bf76a86b408f492870fffa5e092b925e9a75e56231a3e02fa890b9edd98b
SSDEEP

768:Kf1K2exg2kBwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZsBGGpebVIYLHA3Kx6:o1KhxqwtdgI2MyzNORQtOflIwoHNV2Xn

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001222a-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001222a-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2036	hurok.exe

Loads dropped DLL 1 IoCs

pid	Process
2876	2024-02-21_563e5961ff9da4697296ddeabec0441f_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2876	2024-02-21_563e5961ff9da4697296ddeabec0441f_cryptolocker.exe
2036	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2036	2876	2024-02-21_563e5961ff9da4697296ddeabec0441f_cryptolocker.exe	28
PID 2876 wrote to memory of 2036	2876	2024-02-21_563e5961ff9da4697296ddeabec0441f_cryptolocker.exe	28
PID 2876 wrote to memory of 2036	2876	2024-02-21_563e5961ff9da4697296ddeabec0441f_cryptolocker.exe	28
PID 2876 wrote to memory of 2036	2876	2024-02-21_563e5961ff9da4697296ddeabec0441f_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-21_563e5961ff9da4697296ddeabec0441f_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-21_563e5961ff9da4697296ddeabec0441f_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
45KB

MD5
d8a4dd631ebc7dbb741865ff35563ec2

SHA1
276508dd2dcebaa405f481473c3c6c720565a104

SHA256
6d134153e438f11506fa4febbbd6b9a933ae694daa4b7fe4e1a97ec169ed7bf9

SHA512
d0d784e532286ef470adfe3e9411a24d9903d3d99c0f478d714d9f2261f96e06767373866f26746871be1d2c0fdd42fd5b00d4e179913e67877108b2f1959c01

Download Submit
memory/2036-17-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2876-0-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/2876-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2876-8-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download