Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
13/05/2024, 19:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-13_b4620b96c583abe876fa7022f48a6407_cryptolocker.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-13_b4620b96c583abe876fa7022f48a6407_cryptolocker.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-13_b4620b96c583abe876fa7022f48a6407_cryptolocker.exe
-
Size
30KB
-
MD5
b4620b96c583abe876fa7022f48a6407
-
SHA1
477a558b33d6ab253ef323bf68b1c8ebf605a973
-
SHA256
2285b38070b166c1e6bb2d1568ff12d21eaf76a2058079a0a396682e00b1f492
-
SHA512
49b8eca645fe49a623566bc766fd00bd40f49488980352e352c88ed5f46ce9ada32049530e32c75ccc20571f535d1f2cba3d61b3934515821cbc7ba9a4a6a039
-
SSDEEP
768:Kf1K2exg2kBwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZsBGGbNAKSjNfl:o1KhxqwtdgI2MyzNORQtOflIwoHNV2X4
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
resource yara_rule behavioral1/files/0x000b000000012286-10.dat CryptoLocker_rule2 -
Detection of Cryptolocker Samples 1 IoCs
resource yara_rule behavioral1/files/0x000b000000012286-10.dat CryptoLocker_set1 -
Executes dropped EXE 1 IoCs
pid Process 1260 hurok.exe -
Loads dropped DLL 1 IoCs
pid Process 616 2024-05-13_b4620b96c583abe876fa7022f48a6407_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of UnmapMainImage 2 IoCs
pid Process 616 2024-05-13_b4620b96c583abe876fa7022f48a6407_cryptolocker.exe 1260 hurok.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 616 wrote to memory of 1260 616 2024-05-13_b4620b96c583abe876fa7022f48a6407_cryptolocker.exe 28 PID 616 wrote to memory of 1260 616 2024-05-13_b4620b96c583abe876fa7022f48a6407_cryptolocker.exe 28 PID 616 wrote to memory of 1260 616 2024-05-13_b4620b96c583abe876fa7022f48a6407_cryptolocker.exe 28 PID 616 wrote to memory of 1260 616 2024-05-13_b4620b96c583abe876fa7022f48a6407_cryptolocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-13_b4620b96c583abe876fa7022f48a6407_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-13_b4620b96c583abe876fa7022f48a6407_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Users\Admin\AppData\Local\Temp\hurok.exe"C:\Users\Admin\AppData\Local\Temp\hurok.exe"2⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:1260
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
30KB
MD53a63cde74cd9aa7c0ad94179965c00ea
SHA1dec7538534decaaa6c38a4076155d8c4d6ff7047
SHA256805fefad82311865f6d3907e571ba7d723431cc93fbe2467247a63680af65c59
SHA512924ca0d2c5c68ef38475d3ddd50b129419e8c308c2523174199ef7fb1cea8f94224aae4d376abff717e6497eecb4191e34becafcfd635fe0680b89b9e2785248