a36f98ba74aef1b3b10e33a8b52beae4e3ff2050ffea9e1d988c20a269e3ecfe

Analysis

max time kernel
154s
max time network
165s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/04/2024, 11:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-04-06_5b41cb7d5850be21687cb61ada6e7d8b_cryptolocker.exe
Size

36KB
MD5

5b41cb7d5850be21687cb61ada6e7d8b
SHA1

579ed0a29614b0e3438392c79c0cf2253a1bc91a
SHA256

a36f98ba74aef1b3b10e33a8b52beae4e3ff2050ffea9e1d988c20a269e3ecfe
SHA512

e0dc2d04eaccc7dee7daedce8ab60558fc50fd0d82f36c65b8fe1f2533b3bf3aa9b6433a89906d0b1d4b097911821aea11a2f87538a542fac254d95a7bc50409
SSDEEP

768:Kf1K2exg2kBwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZsBGGp/YIm7wmZshDh:o1KhxqwtdgI2MyzNORQtOflIwoHNV2Xn

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000012254-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000012254-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
1968	hurok.exe

Loads dropped DLL 1 IoCs

pid	Process
2500	2024-04-06_5b41cb7d5850be21687cb61ada6e7d8b_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2500	2024-04-06_5b41cb7d5850be21687cb61ada6e7d8b_cryptolocker.exe
1968	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 1968	2500	2024-04-06_5b41cb7d5850be21687cb61ada6e7d8b_cryptolocker.exe	28
PID 2500 wrote to memory of 1968	2500	2024-04-06_5b41cb7d5850be21687cb61ada6e7d8b_cryptolocker.exe	28
PID 2500 wrote to memory of 1968	2500	2024-04-06_5b41cb7d5850be21687cb61ada6e7d8b_cryptolocker.exe	28
PID 2500 wrote to memory of 1968	2500	2024-04-06_5b41cb7d5850be21687cb61ada6e7d8b_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-06_5b41cb7d5850be21687cb61ada6e7d8b_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-06_5b41cb7d5850be21687cb61ada6e7d8b_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
37KB

MD5
f274e2ec39a705229dc67fbd48c579d5

SHA1
2bdaecf0e3b0144ba9e9263dfe610381e9d2601c

SHA256
9fb8d038f17a472201ff947f1553d601c34361f3d630c3e442d6277117a72dba

SHA512
c6be69bd58a1db6a0a63d26b1f3bec8ac5a1cc2e75f9df074dbe998060248eff430edd3aa9d94f009f78552729e1a581438ee543b0d3fe42ea8e7fb7fa5febce

Download Submit
memory/1968-19-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2500-0-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/2500-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2500-8-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download