6004bba52071aed61a39352b400f028252eb2e17b16de9e253b00ef8f6bd700e

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 16:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-21_71fe49b0438083c07225e3dd0fdacee5_cryptolocker.exe
Size

45KB
MD5

71fe49b0438083c07225e3dd0fdacee5
SHA1

bef2c43717ca2c69634df5eec68cb6fc1f9664ed
SHA256

6004bba52071aed61a39352b400f028252eb2e17b16de9e253b00ef8f6bd700e
SHA512

faab941de16c6d431e47415f8be3aa84e445417375237fafbeb26a9706c79731a14575163b5fead4dafd3944a58cca5dba561c06f71e04b70d7c25fe58b2246c
SSDEEP

768:Kf1K2exg2kBwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZsBGGpebVIYLHA3KxE:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XV

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\hurok.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\hurok.exe	CryptoLocker_set1

Executes dropped EXE 1 IoCs

Processes:

hurok.exe

pid process

2904 hurok.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-21_71fe49b0438083c07225e3dd0fdacee5_cryptolocker.exe

pid process

2916 2024-05-21_71fe49b0438083c07225e3dd0fdacee5_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of UnmapMainImage 2 IoCs

Processes:

2024-05-21_71fe49b0438083c07225e3dd0fdacee5_cryptolocker.exehurok.exe

pid process

2916 2024-05-21_71fe49b0438083c07225e3dd0fdacee5_cryptolocker.exe
2904 hurok.exe

pid	process
2904	hurok.exe

pid	process
2916	2024-05-21_71fe49b0438083c07225e3dd0fdacee5_cryptolocker.exe

pid	process
2916	2024-05-21_71fe49b0438083c07225e3dd0fdacee5_cryptolocker.exe
2904	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-21_71fe49b0438083c07225e3dd0fdacee5_cryptolocker.exe

description	pid	process	target process
PID 2916 wrote to memory of 2904	2916	2024-05-21_71fe49b0438083c07225e3dd0fdacee5_cryptolocker.exe	hurok.exe
PID 2916 wrote to memory of 2904	2916	2024-05-21_71fe49b0438083c07225e3dd0fdacee5_cryptolocker.exe	hurok.exe
PID 2916 wrote to memory of 2904	2916	2024-05-21_71fe49b0438083c07225e3dd0fdacee5_cryptolocker.exe	hurok.exe
PID 2916 wrote to memory of 2904	2916	2024-05-21_71fe49b0438083c07225e3dd0fdacee5_cryptolocker.exe	hurok.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-21_71fe49b0438083c07225e3dd0fdacee5_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-21_71fe49b0438083c07225e3dd0fdacee5_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2916

C:\Users\Admin\AppData\Local\Temp\hurok.exe
"C:\Users\Admin\AppData\Local\Temp\hurok.exe"
2⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2904

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hurok.exe
Filesize
45KB

MD5
b790967db6840cb5cf752e22d699643c

SHA1
85abacbe4a0e709b2321582ab35e6b6d9dbfa73f

SHA256
d55405a150dfcbb1177d4706b1d41ebf53eeec713e0c330d8e270f7950b9d7ca

SHA512
646493afb9f221243c51648e223a45b6a517e5d60e021ba3d9ddc6f2c099314c2c6000d870cf113f765a60a4a44c540dbbff4be31a378e77af2015771eac2ecb

Download Submit
memory/2916-0-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/2916-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2916-8-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download