c175259ed5e47d8cc814edc7bdb16834c867d326df870c3d597af8aa2d73e22a

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 04:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-03-13_71c96bc76d20e2abf4b50f5f9d2c839b_cryptolocker.exe
Size

50KB
MD5

71c96bc76d20e2abf4b50f5f9d2c839b
SHA1

13f6ba9426adad097ca4c2d716e0e934a69ae92c
SHA256

c175259ed5e47d8cc814edc7bdb16834c867d326df870c3d597af8aa2d73e22a
SHA512

9c1b9e03f3e3679632f369d6149ecdfb455adf2cd4f6371e9aef98aae85a351c1c9db5c18c8bb24d94136e1b47ae985e12fcd11c76069478f588f35ab4023be8
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszsbKY1xzpAIKF:aq7tdgI2MyzNORQtOflIwoHNV2XBFV73

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b00000000e610-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000b00000000e610-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2552	hurok.exe

Loads dropped DLL 1 IoCs

pid	Process
2996	2024-03-13_71c96bc76d20e2abf4b50f5f9d2c839b_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2996	2024-03-13_71c96bc76d20e2abf4b50f5f9d2c839b_cryptolocker.exe
2552	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 2552	2996	2024-03-13_71c96bc76d20e2abf4b50f5f9d2c839b_cryptolocker.exe	28
PID 2996 wrote to memory of 2552	2996	2024-03-13_71c96bc76d20e2abf4b50f5f9d2c839b_cryptolocker.exe	28
PID 2996 wrote to memory of 2552	2996	2024-03-13_71c96bc76d20e2abf4b50f5f9d2c839b_cryptolocker.exe	28
PID 2996 wrote to memory of 2552	2996	2024-03-13_71c96bc76d20e2abf4b50f5f9d2c839b_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-13_71c96bc76d20e2abf4b50f5f9d2c839b_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-13_71c96bc76d20e2abf4b50f5f9d2c839b_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
50KB

MD5
7266d589185235e6e2dd9ffd1c81f627

SHA1
b67875a3b5ff871d867ba41bb339cf0d0653d18d

SHA256
14873aa7e8ff1d45bc384c7d1cc0b67cb73b61134a6fd0e09639b279bb14b060

SHA512
739e95d84574a3171a3f08315387f878d4e574bbb424f3bbb1685d0cb9b35a85159a05e172753fade433a7e550d4565a8f852d0f5068f53bef1cf0433720f055

Download Submit
memory/2996-0-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/2996-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2996-2-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download