c2d2ba3440ead57b50f253a46ded94f0fc3676a622e34035fa281def6c298194

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-23_faf996102965acce91f55ca6334586c3_cryptolocker.exe
Size

53KB
MD5

faf996102965acce91f55ca6334586c3
SHA1

c7c5fcd430975631728620c6b5d57fd002b6056a
SHA256

c2d2ba3440ead57b50f253a46ded94f0fc3676a622e34035fa281def6c298194
SHA512

9f1ecb93fc7862f2763b763b358255969b3756da6c8295900734f17394fa24bcbd11ab19cb43359ac6355b0cc58775f773eb3aeee2a79f0463ee29efdc495cbc
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszsbKY1xzpAIKx6Y:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7j

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\hurok.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\hurok.exe	CryptoLocker_set1

Executes dropped EXE 1 IoCs

Processes:

hurok.exe

pid process

3024 hurok.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-23_faf996102965acce91f55ca6334586c3_cryptolocker.exe

pid process

2988 2024-05-23_faf996102965acce91f55ca6334586c3_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of UnmapMainImage 2 IoCs

Processes:

2024-05-23_faf996102965acce91f55ca6334586c3_cryptolocker.exehurok.exe

pid process

2988 2024-05-23_faf996102965acce91f55ca6334586c3_cryptolocker.exe
3024 hurok.exe

pid	process
3024	hurok.exe

pid	process
2988	2024-05-23_faf996102965acce91f55ca6334586c3_cryptolocker.exe

pid	process
2988	2024-05-23_faf996102965acce91f55ca6334586c3_cryptolocker.exe
3024	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-23_faf996102965acce91f55ca6334586c3_cryptolocker.exe

description	pid	process	target process
PID 2988 wrote to memory of 3024	2988	2024-05-23_faf996102965acce91f55ca6334586c3_cryptolocker.exe	hurok.exe
PID 2988 wrote to memory of 3024	2988	2024-05-23_faf996102965acce91f55ca6334586c3_cryptolocker.exe	hurok.exe
PID 2988 wrote to memory of 3024	2988	2024-05-23_faf996102965acce91f55ca6334586c3_cryptolocker.exe	hurok.exe
PID 2988 wrote to memory of 3024	2988	2024-05-23_faf996102965acce91f55ca6334586c3_cryptolocker.exe	hurok.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-23_faf996102965acce91f55ca6334586c3_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_faf996102965acce91f55ca6334586c3_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2988

C:\Users\Admin\AppData\Local\Temp\hurok.exe
"C:\Users\Admin\AppData\Local\Temp\hurok.exe"
2⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
53KB

MD5
671c93f0cd314b122c35c658afcf1468

SHA1
37fb26f9c50a1b512124cb37784afcc6ce73b80d

SHA256
276f63adaba4aba4fb85101c06b01199ac1b9f359bb902eedfe7932a9fc5d88b

SHA512
945a2366f24137d4d4f7081a7518802494867109dd6d9fcb8a64c93b32da9021ffd917c8b9c9dbd7f169b3061310cb32fce3765f76032dc88ba64d74272a81d9

Download Submit
memory/2988-0-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2988-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2988-8-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/3024-23-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download