76e38d7acc9831f75a9a09963db063da16d2ab75f9db0d446ccb8b1da1461020

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-22_dd42dc0052a836f1f6c476cde38025b4_cryptolocker.exe
Size

45KB
MD5

dd42dc0052a836f1f6c476cde38025b4
SHA1

110a2fa5bcd8242eb4024e16690e259216a5c86c
SHA256

76e38d7acc9831f75a9a09963db063da16d2ab75f9db0d446ccb8b1da1461020
SHA512

cc29fe874164b562bf3b0f8b95d7235fc6dd6eb1c8f72d65eff42ecdf1034320bc7aae1d988bd8773d4245965529a76d16ac5b8a6f6cbdcfcf65c62da9c96b0d
SSDEEP

768:Kf1K2exg2kBwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZsBGGpebVIYLHA3Kxv:o1KhxqwtdgI2MyzNORQtOflIwoHNV2Xy

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\hurok.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\hurok.exe	CryptoLocker_set1

Executes dropped EXE 1 IoCs

Processes:

hurok.exe

pid process

2584 hurok.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-22_dd42dc0052a836f1f6c476cde38025b4_cryptolocker.exe

pid process

1868 2024-05-22_dd42dc0052a836f1f6c476cde38025b4_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of UnmapMainImage 2 IoCs

Processes:

2024-05-22_dd42dc0052a836f1f6c476cde38025b4_cryptolocker.exehurok.exe

pid process

1868 2024-05-22_dd42dc0052a836f1f6c476cde38025b4_cryptolocker.exe
2584 hurok.exe

pid	process
2584	hurok.exe

pid	process
1868	2024-05-22_dd42dc0052a836f1f6c476cde38025b4_cryptolocker.exe

pid	process
1868	2024-05-22_dd42dc0052a836f1f6c476cde38025b4_cryptolocker.exe
2584	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-22_dd42dc0052a836f1f6c476cde38025b4_cryptolocker.exe

description	pid	process	target process
PID 1868 wrote to memory of 2584	1868	2024-05-22_dd42dc0052a836f1f6c476cde38025b4_cryptolocker.exe	hurok.exe
PID 1868 wrote to memory of 2584	1868	2024-05-22_dd42dc0052a836f1f6c476cde38025b4_cryptolocker.exe	hurok.exe
PID 1868 wrote to memory of 2584	1868	2024-05-22_dd42dc0052a836f1f6c476cde38025b4_cryptolocker.exe	hurok.exe
PID 1868 wrote to memory of 2584	1868	2024-05-22_dd42dc0052a836f1f6c476cde38025b4_cryptolocker.exe	hurok.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-22_dd42dc0052a836f1f6c476cde38025b4_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_dd42dc0052a836f1f6c476cde38025b4_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1868

C:\Users\Admin\AppData\Local\Temp\hurok.exe
"C:\Users\Admin\AppData\Local\Temp\hurok.exe"
2⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
45KB

MD5
a4af31bbeea7656bdd860d3ae089f91a

SHA1
794bb1b6edea675f2fe222142752c806cf09b866

SHA256
34cec68328da0106cb0efa8070041a552d89b28ff2df0dd55169e76cf750fab8

SHA512
1db5908a2bc88b81182706d7784242ef7ed251bfb83ed0ccd3112cbf11633f31f7402a7661e1c4390062167ecde6afce6b56e4203b1baa389fc3152ce6f94164

Download Submit
memory/1868-0-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/1868-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1868-8-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2584-23-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download