6c9ada02fb53acf740a865f8c78ea440984dd4eaea9f5e6192691de6fab09ade

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 19:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-22_9c27242f10b303ef9991ed9980565dc4_cryptolocker.exe
Size

31KB
MD5

9c27242f10b303ef9991ed9980565dc4
SHA1

46e31661a7fb8be11e48b09867461812d866aac1
SHA256

6c9ada02fb53acf740a865f8c78ea440984dd4eaea9f5e6192691de6fab09ade
SHA512

0322b9bc2c90561b60c6786fe71f2a2cf6bd3de9aa99d9aa4f6c2f1f34c2018138e40eef155cb79b1d8e0bc33e99aa46397e7e63caa1dce23cad00e1cfe16a24
SSDEEP

768:Kf1K2exg2kBwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZsBGGbNAKSjNfS:o1KhxqwtdgI2MyzNORQtOflIwoHNV2Xb

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\hurok.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\hurok.exe	CryptoLocker_set1

Executes dropped EXE 1 IoCs

Processes:

hurok.exe

pid process

2900 hurok.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-22_9c27242f10b303ef9991ed9980565dc4_cryptolocker.exe

pid process

1448 2024-05-22_9c27242f10b303ef9991ed9980565dc4_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of UnmapMainImage 2 IoCs

Processes:

2024-05-22_9c27242f10b303ef9991ed9980565dc4_cryptolocker.exehurok.exe

pid process

1448 2024-05-22_9c27242f10b303ef9991ed9980565dc4_cryptolocker.exe
2900 hurok.exe

pid	process
2900	hurok.exe

pid	process
1448	2024-05-22_9c27242f10b303ef9991ed9980565dc4_cryptolocker.exe

pid	process
1448	2024-05-22_9c27242f10b303ef9991ed9980565dc4_cryptolocker.exe
2900	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-22_9c27242f10b303ef9991ed9980565dc4_cryptolocker.exe

description	pid	process	target process
PID 1448 wrote to memory of 2900	1448	2024-05-22_9c27242f10b303ef9991ed9980565dc4_cryptolocker.exe	hurok.exe
PID 1448 wrote to memory of 2900	1448	2024-05-22_9c27242f10b303ef9991ed9980565dc4_cryptolocker.exe	hurok.exe
PID 1448 wrote to memory of 2900	1448	2024-05-22_9c27242f10b303ef9991ed9980565dc4_cryptolocker.exe	hurok.exe
PID 1448 wrote to memory of 2900	1448	2024-05-22_9c27242f10b303ef9991ed9980565dc4_cryptolocker.exe	hurok.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-22_9c27242f10b303ef9991ed9980565dc4_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_9c27242f10b303ef9991ed9980565dc4_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
31KB

MD5
c133a3ad86cfbf9cd6367ddc70605d6c

SHA1
06ca676ff321e9ba3b20b2cd39d241a1fd17aa1d

SHA256
cae54d6863379388e070e01d81a2aed01a70f44b83c0892cea463fc627cb7d1e

SHA512
77c822fab2ed5193a7b9126546af7aca52bc273be18b7966af96ec4c14d348a2d5da56e9ee84052066903638ce00dea5c625afb38657cf947251e8c5cf7fe19c

Download Submit
memory/1448-0-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/1448-8-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/1448-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2900-16-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download