7691a79dda9f2fffb1c07368c2340042a115364c70721c78b4ae66b8e595ef51

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
16-04-2024 16:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-16_485c993af2c95e03b3570c1fa1592b35_cryptolocker.exe
Size

63KB
MD5

485c993af2c95e03b3570c1fa1592b35
SHA1

08680c3f2688199065792d52730a1b7165612735
SHA256

7691a79dda9f2fffb1c07368c2340042a115364c70721c78b4ae66b8e595ef51
SHA512

038a8d6bbeb22881d4b5b9947088925b60be35692f7ce8c2ff5b96eaa47f3b53774193d21033f15987b80a903fe0ee424b03717b85e5fa59a386ab1b5cabfee6
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszsbKY1x/9lfL+gniDSAar:aq7tdgI2MyzNORQtOflIwoHNV2XBFV74

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000015d1a-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000015d1a-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
760	hurok.exe

Loads dropped DLL 1 IoCs

pid	Process
2044	2024-04-16_485c993af2c95e03b3570c1fa1592b35_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2044	2024-04-16_485c993af2c95e03b3570c1fa1592b35_cryptolocker.exe
760	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 760	2044	2024-04-16_485c993af2c95e03b3570c1fa1592b35_cryptolocker.exe	28
PID 2044 wrote to memory of 760	2044	2024-04-16_485c993af2c95e03b3570c1fa1592b35_cryptolocker.exe	28
PID 2044 wrote to memory of 760	2044	2024-04-16_485c993af2c95e03b3570c1fa1592b35_cryptolocker.exe	28
PID 2044 wrote to memory of 760	2044	2024-04-16_485c993af2c95e03b3570c1fa1592b35_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-16_485c993af2c95e03b3570c1fa1592b35_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-16_485c993af2c95e03b3570c1fa1592b35_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
63KB

MD5
c86b3ba578f2aae00edccd1cb3918dbd

SHA1
522096921da49d0938f9583d4e945868859be313

SHA256
7bb9c8fbeab0f6b64c9b44810041428393f0135c56bc43cbeea499bd0e6d9983

SHA512
2fe5c56abe95836c1314bbb052276e00da744010d795e556e63e7833e05a53df857fc00f53a0ce9091d36858993e4e7b75ec3a27f7711e22e3dcc8cf9c449ca7

Download Submit
memory/760-23-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2044-0-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/2044-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2044-2-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download