84ce7566c4f01ef183b2c62db2e2cf2fe737a432eee5fc104761ebe5f007b6dc

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 19:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-21_f1f66efc5e2b4ceb810e2830e25fb899_cryptolocker.exe
Size

53KB
MD5

f1f66efc5e2b4ceb810e2830e25fb899
SHA1

9d669cb7c7a5a6e3ed35eae9072ca1918d11d84f
SHA256

84ce7566c4f01ef183b2c62db2e2cf2fe737a432eee5fc104761ebe5f007b6dc
SHA512

e36fd5cb6c847b2e0f40d81e459d7f01fab0fc45ba4256e89859b45d01a0dad7ec4649ff115c6984522428c0ce02779e9183c6ef66ef108d8c398ddc509a8774
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszsbKY1xzpAI4kjmn:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7H

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\hurok.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\hurok.exe	CryptoLocker_set1

Executes dropped EXE 1 IoCs

Processes:

hurok.exe

pid process

2632 hurok.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-21_f1f66efc5e2b4ceb810e2830e25fb899_cryptolocker.exe

pid process

2424 2024-05-21_f1f66efc5e2b4ceb810e2830e25fb899_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of UnmapMainImage 2 IoCs

Processes:

2024-05-21_f1f66efc5e2b4ceb810e2830e25fb899_cryptolocker.exehurok.exe

pid process

2424 2024-05-21_f1f66efc5e2b4ceb810e2830e25fb899_cryptolocker.exe
2632 hurok.exe

pid	process
2632	hurok.exe

pid	process
2424	2024-05-21_f1f66efc5e2b4ceb810e2830e25fb899_cryptolocker.exe

pid	process
2424	2024-05-21_f1f66efc5e2b4ceb810e2830e25fb899_cryptolocker.exe
2632	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-21_f1f66efc5e2b4ceb810e2830e25fb899_cryptolocker.exe

description	pid	process	target process
PID 2424 wrote to memory of 2632	2424	2024-05-21_f1f66efc5e2b4ceb810e2830e25fb899_cryptolocker.exe	hurok.exe
PID 2424 wrote to memory of 2632	2424	2024-05-21_f1f66efc5e2b4ceb810e2830e25fb899_cryptolocker.exe	hurok.exe
PID 2424 wrote to memory of 2632	2424	2024-05-21_f1f66efc5e2b4ceb810e2830e25fb899_cryptolocker.exe	hurok.exe
PID 2424 wrote to memory of 2632	2424	2024-05-21_f1f66efc5e2b4ceb810e2830e25fb899_cryptolocker.exe	hurok.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-21_f1f66efc5e2b4ceb810e2830e25fb899_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-21_f1f66efc5e2b4ceb810e2830e25fb899_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
53KB

MD5
55a06a1cb1a25738f2352aa4f9dff1d5

SHA1
72c2a381efde370ead840ce8028217eaf74e66ee

SHA256
5c8dd388d05077c19f76dfb4176f20f82d3558032bd6f2f17675f37f5e4937eb

SHA512
95a969fcab4a9d69ee62944f5d23be2b3eeff9189c057210c20f4c7bea26ef6921b54c8c535c35642a17e5227c476745af50e441a969f6d44f4fc357b0f49b24

Download Submit
memory/2424-0-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/2424-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2424-8-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/2632-23-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download