fa7c8ea6e65a3a50ebbbab4853c51569864dba79af48cbf4929a46fcc58361cf

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
29-04-2024 06:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-29_1ad6fd486496a118cc4c9b6ca797edf6_cryptolocker.exe
Size

51KB
MD5

1ad6fd486496a118cc4c9b6ca797edf6
SHA1

06a0ed0bcfda4087fed09790dd0a686ed58d55c9
SHA256

fa7c8ea6e65a3a50ebbbab4853c51569864dba79af48cbf4929a46fcc58361cf
SHA512

9157675dad5ab8387490de19f69e81c805c0e1ccf01b8e27942a97f03880b0924e37ebee063638c1d2d3fdd8cbc73f4cbb5675f9cf27f4c970ccfe6fcc47b312
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszsbKY1xzpAI4r:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7/

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000f000000012331-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000f000000012331-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2548	hurok.exe

Loads dropped DLL 1 IoCs

pid	Process
2924	2024-04-29_1ad6fd486496a118cc4c9b6ca797edf6_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2924	2024-04-29_1ad6fd486496a118cc4c9b6ca797edf6_cryptolocker.exe
2548	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2548	2924	2024-04-29_1ad6fd486496a118cc4c9b6ca797edf6_cryptolocker.exe	28
PID 2924 wrote to memory of 2548	2924	2024-04-29_1ad6fd486496a118cc4c9b6ca797edf6_cryptolocker.exe	28
PID 2924 wrote to memory of 2548	2924	2024-04-29_1ad6fd486496a118cc4c9b6ca797edf6_cryptolocker.exe	28
PID 2924 wrote to memory of 2548	2924	2024-04-29_1ad6fd486496a118cc4c9b6ca797edf6_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-29_1ad6fd486496a118cc4c9b6ca797edf6_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-29_1ad6fd486496a118cc4c9b6ca797edf6_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
52KB

MD5
a619b7b3314854c68cb41415eba27f46

SHA1
06dea50727d365b2c7655bd85aea838420da212c

SHA256
4100f90c539e4faf3ea1c67cc527f3e4fbf53dd0ddf80a2a72db872653bce4cc

SHA512
bfd1bc8580c61e482f503259c8b92b4829658c3ad662e211d2b7b63b33a7b2203467c56cffd0cbad11c262bfbe5fa570e8de082fea471a57bdc9d2033218a633

Download Submit
memory/2548-23-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2924-8-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2924-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2924-0-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download