b9cb13d8cb180524a0d93d7711855891c9acd2ebb047638c062581fcdf26a6c2

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 07:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-24_a025e40ecb609a02762f0a0d9f70bca4_cryptolocker.exe
Size

45KB
MD5

a025e40ecb609a02762f0a0d9f70bca4
SHA1

c1adb073bd39f745f3bfe68829421e82d2100f0a
SHA256

b9cb13d8cb180524a0d93d7711855891c9acd2ebb047638c062581fcdf26a6c2
SHA512

54ef9538f404d9686d534c441cf53abb01878058c85eb2e33c9c331f1b554c1ee729ead643ab62e04937f66651d0c6639283ddf7ae423dc99815d61ad91a8865
SSDEEP

768:Kf1K2exg2kBwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZsBGGpebVIYLHA3Kxi:o1KhxqwtdgI2MyzNORQtOflIwoHNV2X3

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000012252-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000012252-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2580	hurok.exe

Loads dropped DLL 1 IoCs

pid	Process
2700	2024-02-24_a025e40ecb609a02762f0a0d9f70bca4_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2700	2024-02-24_a025e40ecb609a02762f0a0d9f70bca4_cryptolocker.exe
2580	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2580	2700	2024-02-24_a025e40ecb609a02762f0a0d9f70bca4_cryptolocker.exe	28
PID 2700 wrote to memory of 2580	2700	2024-02-24_a025e40ecb609a02762f0a0d9f70bca4_cryptolocker.exe	28
PID 2700 wrote to memory of 2580	2700	2024-02-24_a025e40ecb609a02762f0a0d9f70bca4_cryptolocker.exe	28
PID 2700 wrote to memory of 2580	2700	2024-02-24_a025e40ecb609a02762f0a0d9f70bca4_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-24_a025e40ecb609a02762f0a0d9f70bca4_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-24_a025e40ecb609a02762f0a0d9f70bca4_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
45KB

MD5
a0899a885bd5a64cb18dcb4917aef651

SHA1
fca2ac70ca3f64b560685cbe4675917c60c5c6ec

SHA256
08c129c8bba89bc07b27b1f3de85e97baecf983968ec3ea739c050d8eba00dd2

SHA512
4c060e50e50322b61417789d69efafce71de80273360a10e3fc947980ad139f055d0ab365b37ca9eed7bbc40455f4eec263a4cb3c7a98fa337e1e1c75e845049

Download Submit
memory/2580-17-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/2700-0-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2700-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2700-8-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download