Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    09/05/2024, 23:23

General

  • Target

    2024-05-09_168d562e1b81ab73d9bb2f5f03c190d5_cryptolocker.exe

  • Size

    64KB

  • MD5

    168d562e1b81ab73d9bb2f5f03c190d5

  • SHA1

    d43a5242dd976abd613655d11dd1ef26f459f15d

  • SHA256

    224db769c7dcba48ca4f0999f4a44e8e43d5a123c3c15ef683da1ae53d67b37b

  • SHA512

    e03e4ba5cdbf4b13ef551ed8a291680ec9a0c5c66ef15e50634bc2fe3eb8b9df39a996a7a532db9d594bbf3fca5eba618c1fc956cf5240ca5275e56e10d0fd48

  • SSDEEP

    1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszudnYTjipvF293CiVm:aq7tdgI2MyzNORQtOflIwoHNV2XBFV72

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-09_168d562e1b81ab73d9bb2f5f03c190d5_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-09_168d562e1b81ab73d9bb2f5f03c190d5_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2384
    • C:\Users\Admin\AppData\Local\Temp\hurok.exe
      "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2364

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\hurok.exe

          Filesize

          64KB

          MD5

          467d447e4dcd1bc667c92e0644d7d8f0

          SHA1

          4e6f35bd660ba05e05b715d5b9c5aec90ef946ea

          SHA256

          a0d0371b1f5029d4e42f5e720e6fd1dea9de478b4afe5cfc5812f914d17bfa51

          SHA512

          541761259fed6395f68986beaddeef7ee056355cc58e71b60819d4fdf9329679b5f2be26112a693cf860f666f92810dc3372ac5871a61092fe2873cc0301e3fd

        • memory/2364-23-0x0000000000230000-0x0000000000236000-memory.dmp

          Filesize

          24KB

        • memory/2384-1-0x0000000000400000-0x0000000000406000-memory.dmp

          Filesize

          24KB

        • memory/2384-8-0x00000000001C0000-0x00000000001C6000-memory.dmp

          Filesize

          24KB

        • memory/2384-0-0x00000000001C0000-0x00000000001C6000-memory.dmp

          Filesize

          24KB