4c6bd05ef2bbcca956642785b98794897d6159376a94ad9251858c48ceffdd00

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-06-2024 13:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-09_b3689a3f05f263cd6b257d62c217b61f_cryptolocker.exe
Size

54KB
MD5

b3689a3f05f263cd6b257d62c217b61f
SHA1

7e0edc2309970047c90a5f1ff31999fc35d409fb
SHA256

4c6bd05ef2bbcca956642785b98794897d6159376a94ad9251858c48ceffdd00
SHA512

67e60cf37e7ad46874f97a6c2f19a34adbd5915563778d51913bf0c5e71e5a0a871af4e8e21870f69e986d3aac76b667c4afca9ba4113b28a70077ecab7db0b3
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszsbKY1xzpAI4kjmx:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7R

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b00000001267a-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000b00000001267a-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2920	hurok.exe

Loads dropped DLL 1 IoCs

pid	Process
2908	2024-06-09_b3689a3f05f263cd6b257d62c217b61f_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2908	2024-06-09_b3689a3f05f263cd6b257d62c217b61f_cryptolocker.exe
2920	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2920	2908	2024-06-09_b3689a3f05f263cd6b257d62c217b61f_cryptolocker.exe	28
PID 2908 wrote to memory of 2920	2908	2024-06-09_b3689a3f05f263cd6b257d62c217b61f_cryptolocker.exe	28
PID 2908 wrote to memory of 2920	2908	2024-06-09_b3689a3f05f263cd6b257d62c217b61f_cryptolocker.exe	28
PID 2908 wrote to memory of 2920	2908	2024-06-09_b3689a3f05f263cd6b257d62c217b61f_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-06-09_b3689a3f05f263cd6b257d62c217b61f_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-09_b3689a3f05f263cd6b257d62c217b61f_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
54KB

MD5
6e8fc4505df1dea3412e5bc6d094bb4c

SHA1
d53d06c5603ad0f5b3296aabb2a39eea574540ab

SHA256
33f50c9ce5c2e97e9522f04732b9cb1496b6038c8a4f73b0623845399bde4a94

SHA512
bc3ea1f6770d4dc7b364fde4bff55eb52458ffa3b1ae21ad234d2878787dc36afe549ec5bc032bbf777e9ac6ffae10161f0e6321297a09b3cfb5df051a196413

Download Submit
memory/2908-0-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2908-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2908-8-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2920-23-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download