d6a1420a8ea13798db198dc71b0834e60c58a8eaf46408c5d20b0e2b58813de3

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 23:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-22_3070c782a4d6762e10a206223cf2f56d_cryptolocker.exe
Size

65KB
MD5

3070c782a4d6762e10a206223cf2f56d
SHA1

26551122691ce18a7fa32180c89565411b79635e
SHA256

d6a1420a8ea13798db198dc71b0834e60c58a8eaf46408c5d20b0e2b58813de3
SHA512

6299e922f81313c4bb159643ecb60373593f2059d4d4f7aa82672f99fa533c1ef8c385b7f12a6d09a71d7ba60f7c9533beda40f57c436b09451fbe5cb9f2c26e
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszudnYTjipvF299NT:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7R

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\hurok.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\hurok.exe	CryptoLocker_set1

Executes dropped EXE 1 IoCs

Processes:

hurok.exe

pid process

2192 hurok.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-22_3070c782a4d6762e10a206223cf2f56d_cryptolocker.exe

pid process

756 2024-05-22_3070c782a4d6762e10a206223cf2f56d_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of UnmapMainImage 2 IoCs

Processes:

2024-05-22_3070c782a4d6762e10a206223cf2f56d_cryptolocker.exehurok.exe

pid process

756 2024-05-22_3070c782a4d6762e10a206223cf2f56d_cryptolocker.exe
2192 hurok.exe

pid	process
2192	hurok.exe

pid	process
756	2024-05-22_3070c782a4d6762e10a206223cf2f56d_cryptolocker.exe

pid	process
756	2024-05-22_3070c782a4d6762e10a206223cf2f56d_cryptolocker.exe
2192	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-22_3070c782a4d6762e10a206223cf2f56d_cryptolocker.exe

description	pid	process	target process
PID 756 wrote to memory of 2192	756	2024-05-22_3070c782a4d6762e10a206223cf2f56d_cryptolocker.exe	hurok.exe
PID 756 wrote to memory of 2192	756	2024-05-22_3070c782a4d6762e10a206223cf2f56d_cryptolocker.exe	hurok.exe
PID 756 wrote to memory of 2192	756	2024-05-22_3070c782a4d6762e10a206223cf2f56d_cryptolocker.exe	hurok.exe
PID 756 wrote to memory of 2192	756	2024-05-22_3070c782a4d6762e10a206223cf2f56d_cryptolocker.exe	hurok.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-22_3070c782a4d6762e10a206223cf2f56d_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_3070c782a4d6762e10a206223cf2f56d_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:756

C:\Users\Admin\AppData\Local\Temp\hurok.exe
"C:\Users\Admin\AppData\Local\Temp\hurok.exe"
2⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
65KB

MD5
2575460f9aa3c3849fc73ce10a711d97

SHA1
9aaba5a90e5c5e3c9cfc60a416e8e329c5617715

SHA256
9c7898eaa5cdbb6524b500279e8f942b24781cac9a975f011f25d911897c3e62

SHA512
0a8e0843df4769968e827423d64186ef1f712f3aad4b3c97b38542b155bb526b5855d30eec94491ac3208c128778f6fa7b028dd21365986105736aa9edd80e58

Download Submit
memory/756-0-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/756-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/756-8-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download