004ab0425b25a20a85c764c68dcef625c6c5d983686902499d2046c98d75a3d1

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 04:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-10_d12d4c4f4af43b3eb2d77cabd827ecb2_cryptolocker.exe
Size

65KB
MD5

d12d4c4f4af43b3eb2d77cabd827ecb2
SHA1

3f58c00db870546a21babbf1fdfb23bf3455853e
SHA256

004ab0425b25a20a85c764c68dcef625c6c5d983686902499d2046c98d75a3d1
SHA512

333d559dcb02509eb61d5f48ef9282f0eee6faff930579a129e9710410ac8cf8236f5c7b831ab62757e914b4ca95b7b5a3d1fb1cec3263c3b84bf87379032050
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszudnYTjipvF299848:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7g

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000a0000000122ec-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000a0000000122ec-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2420	hurok.exe

Loads dropped DLL 1 IoCs

pid	Process
1716	2024-05-10_d12d4c4f4af43b3eb2d77cabd827ecb2_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1716	2024-05-10_d12d4c4f4af43b3eb2d77cabd827ecb2_cryptolocker.exe
2420	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 2420	1716	2024-05-10_d12d4c4f4af43b3eb2d77cabd827ecb2_cryptolocker.exe	28
PID 1716 wrote to memory of 2420	1716	2024-05-10_d12d4c4f4af43b3eb2d77cabd827ecb2_cryptolocker.exe	28
PID 1716 wrote to memory of 2420	1716	2024-05-10_d12d4c4f4af43b3eb2d77cabd827ecb2_cryptolocker.exe	28
PID 1716 wrote to memory of 2420	1716	2024-05-10_d12d4c4f4af43b3eb2d77cabd827ecb2_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-10_d12d4c4f4af43b3eb2d77cabd827ecb2_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-10_d12d4c4f4af43b3eb2d77cabd827ecb2_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
65KB

MD5
cf3b42e2bd836cada8279777b5353f0e

SHA1
f6c6a43dc1e3dbd9d880e33a21101559e6f108ac

SHA256
fa2b208946e46911789861c2a33554de6068502e5d5c34bede7873534609266f

SHA512
9601f4e43f3e41fbd333d6272f5e9da08f11fbe638402a47d00c7aa7126c4c10839e528002b0a4273ff953a5778ade2c76c89f20d5b561acf1e4a2707fb4c37e

Download Submit
memory/1716-0-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/1716-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1716-8-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2420-23-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download