e05c2443e4f86a3b186ba1ac8bf90c97cfa780916a9778bcc87933cedce8fef4

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-02-2024 20:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-23_94c986cafead6527ff1a90764c1cf538_cryptolocker.exe
Size

35KB
MD5

94c986cafead6527ff1a90764c1cf538
SHA1

5ab1eae77157bdf1e572b7a091712a333cdf7830
SHA256

e05c2443e4f86a3b186ba1ac8bf90c97cfa780916a9778bcc87933cedce8fef4
SHA512

b50dda0268915917311f972ec144f02550b8d6f889f266bac2ef35a1fb1fa7c5f29f19481067facc44343ca05452997466f36b0410861e016eba9d28e4165e7e
SSDEEP

768:Kf1K2exg2kBwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZsBGGp/YIm7wmk4:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XW

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000d00000001224d-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000d00000001224d-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2392	hurok.exe

Loads dropped DLL 1 IoCs

pid	Process
2852	2024-02-23_94c986cafead6527ff1a90764c1cf538_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2852	2024-02-23_94c986cafead6527ff1a90764c1cf538_cryptolocker.exe
2392	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 2392	2852	2024-02-23_94c986cafead6527ff1a90764c1cf538_cryptolocker.exe	28
PID 2852 wrote to memory of 2392	2852	2024-02-23_94c986cafead6527ff1a90764c1cf538_cryptolocker.exe	28
PID 2852 wrote to memory of 2392	2852	2024-02-23_94c986cafead6527ff1a90764c1cf538_cryptolocker.exe	28
PID 2852 wrote to memory of 2392	2852	2024-02-23_94c986cafead6527ff1a90764c1cf538_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-23_94c986cafead6527ff1a90764c1cf538_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-23_94c986cafead6527ff1a90764c1cf538_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
35KB

MD5
53b0a4747328380b833e8bb5fe4b3a60

SHA1
aad965268f725d1cbf00437d71a33993547b6cbb

SHA256
987c8214e75a6523e1aa0d17ee55de6f951220b79d690986bb1b36533acd79ee

SHA512
0e022bdf2cc08b19188ab8f59439ecc9250b3bb9ff49aecadb1a4de05174939622ee9fdb3504d0390f1234d64e1b7c21fb9d9d52c37660b87c7105890c23e588

Download Submit
memory/2852-0-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/2852-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2852-3-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download