5603e0c2401dfe3ae111b93247ee3e14854d32608baa5d537a978117b8079c65

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 21:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-22_333aaea89e36291f90c36b2886ff52fe_cryptolocker.exe
Size

37KB
MD5

333aaea89e36291f90c36b2886ff52fe
SHA1

b4bf6f8bf73fe2a81543122d5bf0c972ba43e922
SHA256

5603e0c2401dfe3ae111b93247ee3e14854d32608baa5d537a978117b8079c65
SHA512

19a05ce91ae38c78614d4370de5b9045d4e04c1d7955aec3302912189f272b80ff6b42f83a2f999890115f1783b03698780771dca9211ed3e38ce0a1ecc25dc6
SSDEEP

768:Kf1K2exg2kBwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZsBGGp/YIm7wm0Ux:o1KhxqwtdgI2MyzNORQtOflIwoHNV2Xe

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\hurok.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\hurok.exe	CryptoLocker_set1

Executes dropped EXE 1 IoCs

Processes:

hurok.exe

pid process

3068 hurok.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-22_333aaea89e36291f90c36b2886ff52fe_cryptolocker.exe

pid process

2284 2024-05-22_333aaea89e36291f90c36b2886ff52fe_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of UnmapMainImage 2 IoCs

Processes:

2024-05-22_333aaea89e36291f90c36b2886ff52fe_cryptolocker.exehurok.exe

pid process

2284 2024-05-22_333aaea89e36291f90c36b2886ff52fe_cryptolocker.exe
3068 hurok.exe

pid	process
3068	hurok.exe

pid	process
2284	2024-05-22_333aaea89e36291f90c36b2886ff52fe_cryptolocker.exe

pid	process
2284	2024-05-22_333aaea89e36291f90c36b2886ff52fe_cryptolocker.exe
3068	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-22_333aaea89e36291f90c36b2886ff52fe_cryptolocker.exe

description	pid	process	target process
PID 2284 wrote to memory of 3068	2284	2024-05-22_333aaea89e36291f90c36b2886ff52fe_cryptolocker.exe	hurok.exe
PID 2284 wrote to memory of 3068	2284	2024-05-22_333aaea89e36291f90c36b2886ff52fe_cryptolocker.exe	hurok.exe
PID 2284 wrote to memory of 3068	2284	2024-05-22_333aaea89e36291f90c36b2886ff52fe_cryptolocker.exe	hurok.exe
PID 2284 wrote to memory of 3068	2284	2024-05-22_333aaea89e36291f90c36b2886ff52fe_cryptolocker.exe	hurok.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-22_333aaea89e36291f90c36b2886ff52fe_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_333aaea89e36291f90c36b2886ff52fe_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
37KB

MD5
12f9ad8aab49bd563f8491dad25b9a33

SHA1
1dea588b630fd1d7f9c909693dbe70a8208bc8be

SHA256
45bdd78aa9ccd654f406fc6a03e425bbd60df8bb9f6b63b7dc3149f82d47b754

SHA512
b084161f76da20c22717322a99b46615097f5b0aa11af94c93e254c7a2ec7b84f11170fa9641dc8aac9bb85850a9452a8e705f5de700e769cdf0874501b09df7

Download Submit
memory/2284-8-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2284-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2284-0-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download