76b483af624a9d6c520007865d1c1c19705a42842dd4e5b7d18e921c6be6f432

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 05:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-05-15_e2972d4eaf2b16fffc84d7f1961523cf_cryptolocker.exe
Size

44KB
MD5

e2972d4eaf2b16fffc84d7f1961523cf
SHA1

15dd340b94de6e77909c61fb0735d414c793b3e1
SHA256

76b483af624a9d6c520007865d1c1c19705a42842dd4e5b7d18e921c6be6f432
SHA512

ed270c95944ecc2e326779b63c17c43633fb685518844269999760a51462b98d523abaec6d8df19073092479b7b4aefa2a864565d57c01d3730bd77ed6978558
SSDEEP

768:Kf1K2exg2kBwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZsBGGpebVIYLHA3KxB:o1KhxqwtdgI2MyzNORQtOflIwoHNV2Xo

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b00000001225d-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000b00000001225d-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2132	hurok.exe

Loads dropped DLL 1 IoCs

pid	Process
108	2024-05-15_e2972d4eaf2b16fffc84d7f1961523cf_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
108	2024-05-15_e2972d4eaf2b16fffc84d7f1961523cf_cryptolocker.exe
2132	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 108 wrote to memory of 2132	108	2024-05-15_e2972d4eaf2b16fffc84d7f1961523cf_cryptolocker.exe	28
PID 108 wrote to memory of 2132	108	2024-05-15_e2972d4eaf2b16fffc84d7f1961523cf_cryptolocker.exe	28
PID 108 wrote to memory of 2132	108	2024-05-15_e2972d4eaf2b16fffc84d7f1961523cf_cryptolocker.exe	28
PID 108 wrote to memory of 2132	108	2024-05-15_e2972d4eaf2b16fffc84d7f1961523cf_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-15_e2972d4eaf2b16fffc84d7f1961523cf_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-15_e2972d4eaf2b16fffc84d7f1961523cf_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:108
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
44KB

MD5
1fb9daf0119cab5dfd79bbdfa6e08607

SHA1
2260a231a0188ae8e4732edc26842b52325eabdf

SHA256
0b75ad5adc1f30b179663f481cb24b2a1879d555ad47ebb6b7cfac7ef5f2f1cb

SHA512
1a14d746e8492a7e18ff3b00d84b97ce3d6a4d0b19ab4f7356feef9566dde0ba6e3010bab5c68786ddcdf22feb9432753c187edcdaadba03ac0bbd600df225e7

Download Submit
memory/108-0-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/108-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/108-8-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/2132-23-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download