15efda09f91a69826eed358060366d065fbf9e8006df2f112ba17382ac895a22

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 04:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-05-30_fc72bcd469373811fd5589d52d5cd4a1_cryptolocker.exe
Size

67KB
MD5

fc72bcd469373811fd5589d52d5cd4a1
SHA1

f0ce5a43426145bee09beec5ffce61eb1240811a
SHA256

15efda09f91a69826eed358060366d065fbf9e8006df2f112ba17382ac895a22
SHA512

41778f9516a4cf49385ceda16478ce1e390e032b2f9244f027b51edd1ae85cf4f896bf90273163bc546a89d92083ad63102c26bfdbf379a2b390e2169d28ae98
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszudnYTjipvF293vaRLP:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7i

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000d000000012271-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000d000000012271-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2152	hurok.exe

Loads dropped DLL 1 IoCs

pid	Process
2052	2024-05-30_fc72bcd469373811fd5589d52d5cd4a1_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2052	2024-05-30_fc72bcd469373811fd5589d52d5cd4a1_cryptolocker.exe
2152	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 2152	2052	2024-05-30_fc72bcd469373811fd5589d52d5cd4a1_cryptolocker.exe	28
PID 2052 wrote to memory of 2152	2052	2024-05-30_fc72bcd469373811fd5589d52d5cd4a1_cryptolocker.exe	28
PID 2052 wrote to memory of 2152	2052	2024-05-30_fc72bcd469373811fd5589d52d5cd4a1_cryptolocker.exe	28
PID 2052 wrote to memory of 2152	2052	2024-05-30_fc72bcd469373811fd5589d52d5cd4a1_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-30_fc72bcd469373811fd5589d52d5cd4a1_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-30_fc72bcd469373811fd5589d52d5cd4a1_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
68KB

MD5
c4cb885df584d42aeb66aa3b4f497baf

SHA1
37e1b72b3c24643d8c8a092bfeb9132e4295e062

SHA256
1722ed6cfe14a111852a8085554d239b29e096c1be88ab8b5e71546ef56550b2

SHA512
d1abb8647fbe9aa1e6823d5130ce5e88c9f559eb4dbe30073e5674facd70757105ac44fcbf2ee34c6b033ba141088ca07069304b49c38180259ffb1454b902dc

Download Submit
memory/2052-0-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/2052-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2052-8-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download