763f57632ce0652e85919e01cab172abf1ad8135ac52936ef52add24e063aeb3

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 21:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-22_15a1b620740d2c4c76962412c2594d21_cryptolocker.exe
Size

53KB
MD5

15a1b620740d2c4c76962412c2594d21
SHA1

116bcc59e5663bd5370f1f20a6568c59fc36b78c
SHA256

763f57632ce0652e85919e01cab172abf1ad8135ac52936ef52add24e063aeb3
SHA512

6e8c8ab62e6c63902f6cf7b6b8ee366975a3c73cea4a0671ef4732151958f182c8b3f4e9a607d43280929fce10d880c6b2ec74e0fc8dc89a31ff139767daea52
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszsbKY1xzpAIKx6O:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7Z

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\hurok.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\hurok.exe	CryptoLocker_set1

Executes dropped EXE 1 IoCs

Processes:

hurok.exe

pid process

1636 hurok.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-22_15a1b620740d2c4c76962412c2594d21_cryptolocker.exe

pid process

1732 2024-05-22_15a1b620740d2c4c76962412c2594d21_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of UnmapMainImage 2 IoCs

Processes:

2024-05-22_15a1b620740d2c4c76962412c2594d21_cryptolocker.exehurok.exe

pid process

1732 2024-05-22_15a1b620740d2c4c76962412c2594d21_cryptolocker.exe
1636 hurok.exe

pid	process
1636	hurok.exe

pid	process
1732	2024-05-22_15a1b620740d2c4c76962412c2594d21_cryptolocker.exe

pid	process
1732	2024-05-22_15a1b620740d2c4c76962412c2594d21_cryptolocker.exe
1636	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-22_15a1b620740d2c4c76962412c2594d21_cryptolocker.exe

description	pid	process	target process
PID 1732 wrote to memory of 1636	1732	2024-05-22_15a1b620740d2c4c76962412c2594d21_cryptolocker.exe	hurok.exe
PID 1732 wrote to memory of 1636	1732	2024-05-22_15a1b620740d2c4c76962412c2594d21_cryptolocker.exe	hurok.exe
PID 1732 wrote to memory of 1636	1732	2024-05-22_15a1b620740d2c4c76962412c2594d21_cryptolocker.exe	hurok.exe
PID 1732 wrote to memory of 1636	1732	2024-05-22_15a1b620740d2c4c76962412c2594d21_cryptolocker.exe	hurok.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-22_15a1b620740d2c4c76962412c2594d21_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_15a1b620740d2c4c76962412c2594d21_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
53KB

MD5
fde11e7f881ba9eef0411de74afff580

SHA1
a3d9b73527dd2612b424a0570fa1d282403028dc

SHA256
401e0227bd83c2e58dbc2524560fea4a81870657a2f1715143360dcfad65df4c

SHA512
4532bf3cb72307a0850e9017f85a44dd181abc9be80ed6187552817cda2ce1973b2b74ce945cbb90f83b9c0003dc0f5e7ab863f6a49a2356e06fb9bfa39dab8b

Download Submit
memory/1636-23-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/1732-0-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/1732-8-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/1732-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download