db16eac89fb3c8c2352fe2392210305c6bf811ddd39fecb452a4add68ef07dbd

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 16:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-28_69311aceb8944344c44f2043d40b8151_cryptolocker.exe
Size

63KB
MD5

69311aceb8944344c44f2043d40b8151
SHA1

901c7b35c5e245a774998daa9f0c3ae03bd74033
SHA256

db16eac89fb3c8c2352fe2392210305c6bf811ddd39fecb452a4add68ef07dbd
SHA512

dedfe3215e717f5aa837887c0d1ba420d202975df3352d019804e551a06d0ef4c9a8209f22356f8083a5d25ddc0cd9d2075aacd25ec533d4aeb2a73a383db389
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszsbKY1x/9lfL+gniDScGw:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7N

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000d000000014466-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000d000000014466-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2564	hurok.exe

Loads dropped DLL 1 IoCs

pid	Process
1548	2024-02-28_69311aceb8944344c44f2043d40b8151_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1548	2024-02-28_69311aceb8944344c44f2043d40b8151_cryptolocker.exe
2564	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 2564	1548	2024-02-28_69311aceb8944344c44f2043d40b8151_cryptolocker.exe	28
PID 1548 wrote to memory of 2564	1548	2024-02-28_69311aceb8944344c44f2043d40b8151_cryptolocker.exe	28
PID 1548 wrote to memory of 2564	1548	2024-02-28_69311aceb8944344c44f2043d40b8151_cryptolocker.exe	28
PID 1548 wrote to memory of 2564	1548	2024-02-28_69311aceb8944344c44f2043d40b8151_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-28_69311aceb8944344c44f2043d40b8151_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-28_69311aceb8944344c44f2043d40b8151_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
63KB

MD5
3866a57db3b7c052dbc14dc1141e5dd3

SHA1
1d109b09410397e1b9423f2a3a405c738d1b9c0a

SHA256
6a59c9dd388b26b9bce934b2ca5d1f2b637a05a044bc1d6fe4ea3e3caddd27f1

SHA512
267af9fc0cb6212fb11ad46037c34b7436f7fe52e48325435d6d51f62cb0abc88adc0147437d659eba189bc07a11542ab8338f548fc98a12d202861bb833073b

Download Submit
memory/1548-0-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/1548-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1548-6-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2564-23-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download