3975b03bcd1e536f4b8186d590929e31747c020d7554dc210b1b326b8479af62

Analysis

max time kernel
147s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 04:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-14_b3950d09cf8806fbe32faf2de82068ce_cryptolocker.exe
Size

64KB
MD5

b3950d09cf8806fbe32faf2de82068ce
SHA1

b4758eca726efbc445994c12a96eafc78f36f469
SHA256

3975b03bcd1e536f4b8186d590929e31747c020d7554dc210b1b326b8479af62
SHA512

e9fe59bc8e848297fb697237248f9b041c380364a7d176edd51bfe3689d557e24c8978a331a142a1d68d71038521a8f85b2c860e16a33a23f46bd0e72bc7e0f3
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszudnYTjipvF29M23:aq7tdgI2MyzNORQtOflIwoHNV2XBFV73

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001224c-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001224c-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2780	hurok.exe

Loads dropped DLL 1 IoCs

pid	Process
2904	2024-03-14_b3950d09cf8806fbe32faf2de82068ce_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2904	2024-03-14_b3950d09cf8806fbe32faf2de82068ce_cryptolocker.exe
2780	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 2780	2904	2024-03-14_b3950d09cf8806fbe32faf2de82068ce_cryptolocker.exe	28
PID 2904 wrote to memory of 2780	2904	2024-03-14_b3950d09cf8806fbe32faf2de82068ce_cryptolocker.exe	28
PID 2904 wrote to memory of 2780	2904	2024-03-14_b3950d09cf8806fbe32faf2de82068ce_cryptolocker.exe	28
PID 2904 wrote to memory of 2780	2904	2024-03-14_b3950d09cf8806fbe32faf2de82068ce_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-14_b3950d09cf8806fbe32faf2de82068ce_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-14_b3950d09cf8806fbe32faf2de82068ce_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
64KB

MD5
c9fbce87b586d27f437d6c30b75fcc70

SHA1
e175a0ab5bf7da9f213726d9dca3a138692efba3

SHA256
5452f9c5f1d93a34a489592d6038664b662d36cd02358f879ea9119bc4b0a6b3

SHA512
08311620a6940826dd46bb0332a7ae1023399774fc272f0d0078c4725768a6d6be1357d34f529238eb3f166ef3ce9d7fc7a9787f34a45008d42b55a79450c9f7

Download Submit
memory/2780-18-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/2904-0-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/2904-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2904-8-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download