ef6a182c7a8425b279fe3c29fd7ce0f885dfa2a2bc48eabc6e4ec0249f5c19da

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/02/2024, 04:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-23_5aa524730473fed7ac5970c3d2876e9a_cryptolocker.exe
Size

62KB
MD5

5aa524730473fed7ac5970c3d2876e9a
SHA1

00817e393d7c4874ea62a03f70684fdea1f2531b
SHA256

ef6a182c7a8425b279fe3c29fd7ce0f885dfa2a2bc48eabc6e4ec0249f5c19da
SHA512

cac95cfff73fa8f263f81d952a4bc92dfcbc920b98441595cca55d0c439587a983b35f1ae365f1efc40d74d4d223796ab4cec1f3d67ec550fd5abc9c8dddb480
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszsbKY1x/9lfL+gniDScG+:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7X

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000900000001222c-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000900000001222c-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2116	hurok.exe

Loads dropped DLL 1 IoCs

pid	Process
2072	2024-02-23_5aa524730473fed7ac5970c3d2876e9a_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2072	2024-02-23_5aa524730473fed7ac5970c3d2876e9a_cryptolocker.exe
2116	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2116	2072	2024-02-23_5aa524730473fed7ac5970c3d2876e9a_cryptolocker.exe	28
PID 2072 wrote to memory of 2116	2072	2024-02-23_5aa524730473fed7ac5970c3d2876e9a_cryptolocker.exe	28
PID 2072 wrote to memory of 2116	2072	2024-02-23_5aa524730473fed7ac5970c3d2876e9a_cryptolocker.exe	28
PID 2072 wrote to memory of 2116	2072	2024-02-23_5aa524730473fed7ac5970c3d2876e9a_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-23_5aa524730473fed7ac5970c3d2876e9a_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-23_5aa524730473fed7ac5970c3d2876e9a_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
63KB

MD5
fd15d7b40d9cb3b4d0c0720a51c00762

SHA1
2cb8411585c742d3a0ed40e6c6818bd7f17d886e

SHA256
edd90674367ae41077093f5f24b6617d5582f0b3bb1acf8aee88031716f84c63

SHA512
c9c6a43790a56df70b2b37a3024f7d322c0ac089d8991c9f9c489c2a14e47cc410aaf60f224e999508cabaa0d8211e5d2aa5b3aa30ef81050083e7d869327d9e

Download Submit
memory/2072-0-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/2072-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2072-2-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/2116-18-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download