e8337eec18b68aef504d0fa73a090e95004c2b4f8e4dada877e26163d0291d31

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-03-2024 06:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-08_e79d26de5267010289edcbe3dcfb23b0_cryptolocker.exe
Size

43KB
MD5

e79d26de5267010289edcbe3dcfb23b0
SHA1

62bc457be6fa141287704d2516899dc163504c24
SHA256

e8337eec18b68aef504d0fa73a090e95004c2b4f8e4dada877e26163d0291d31
SHA512

d5ef9748b1d126cfbe703dc1c74a923efb678467b1fabf1b1bc7a4c850a6aa1f43ade8af53fdb9acb559f708057b43e677f610bc1795537a889fc1508cb79e3d
SSDEEP

768:Kf1K2exg2kBwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZsBGGpebVIYLHA3KxM:o1KhxqwtdgI2MyzNORQtOflIwoHNV2X9

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b000000012255-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000b000000012255-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2000	hurok.exe

Loads dropped DLL 1 IoCs

pid	Process
2144	2024-03-08_e79d26de5267010289edcbe3dcfb23b0_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2144	2024-03-08_e79d26de5267010289edcbe3dcfb23b0_cryptolocker.exe
2000	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 2000	2144	2024-03-08_e79d26de5267010289edcbe3dcfb23b0_cryptolocker.exe	28
PID 2144 wrote to memory of 2000	2144	2024-03-08_e79d26de5267010289edcbe3dcfb23b0_cryptolocker.exe	28
PID 2144 wrote to memory of 2000	2144	2024-03-08_e79d26de5267010289edcbe3dcfb23b0_cryptolocker.exe	28
PID 2144 wrote to memory of 2000	2144	2024-03-08_e79d26de5267010289edcbe3dcfb23b0_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-08_e79d26de5267010289edcbe3dcfb23b0_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-08_e79d26de5267010289edcbe3dcfb23b0_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
43KB

MD5
676eab69e005c3491bf55e59b0edea4a

SHA1
99144fdc655bd1d9fdc6084a1f30df7673388706

SHA256
2313be487f3085f1dcfef1fafffebfc58882d0d29775609b7e1c78dc04d631c8

SHA512
583f887f0f4933effe549180687cd06cfd8415b1d6aa777676c3dcf82c42c3409633b328b983da33023001977e71373fc36d60e435f91c1ddb80d4c3646e806b

Download Submit
memory/2000-20-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2144-0-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/2144-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2144-8-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download