515c4c55a74bad91226f1828026963d0344f4af131c873ffa5febc2ca9c12c81

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/09/2024, 11:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-09-05_02bc95cb3353eca2a04194f2e90696e5_cryptolocker.exe
Size

31KB
MD5

02bc95cb3353eca2a04194f2e90696e5
SHA1

3a86a4d0e39fdf22a093bf238c6538e132f1dd82
SHA256

515c4c55a74bad91226f1828026963d0344f4af131c873ffa5febc2ca9c12c81
SHA512

6b95ee3ae919918d812647e0a11e128594d261997ae5fd1011d54942bbd26fc253e102238cec38f169fc2b8c5b0473d14cffb1bc2ad5ab7403771a26e1cd7f7b
SSDEEP

768:Kf1K2exg2kBwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZsBGGbNAKSjNf0:o1KhxqwtdgI2MyzNORQtOflIwoHNV2Xh

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2780	hurok.exe

Loads dropped DLL 1 IoCs

pid	Process
3004	2024-09-05_02bc95cb3353eca2a04194f2e90696e5_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-05_02bc95cb3353eca2a04194f2e90696e5_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hurok.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3004	2024-09-05_02bc95cb3353eca2a04194f2e90696e5_cryptolocker.exe
2780	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 2780	3004	2024-09-05_02bc95cb3353eca2a04194f2e90696e5_cryptolocker.exe	30
PID 3004 wrote to memory of 2780	3004	2024-09-05_02bc95cb3353eca2a04194f2e90696e5_cryptolocker.exe	30
PID 3004 wrote to memory of 2780	3004	2024-09-05_02bc95cb3353eca2a04194f2e90696e5_cryptolocker.exe	30
PID 3004 wrote to memory of 2780	3004	2024-09-05_02bc95cb3353eca2a04194f2e90696e5_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-09-05_02bc95cb3353eca2a04194f2e90696e5_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-05_02bc95cb3353eca2a04194f2e90696e5_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
32KB

MD5
70e2bc143df901aa3a109c41984ddbfd

SHA1
90dad3d382254a8537e380ca4ba2b2192efd46d4

SHA256
99a1e43f337d447f972d4137a276bacabe647a5ff036c000e8f7f81595d4bc79

SHA512
a0bb045bb80e5a93b2dc79291b4716f0482e79ec4e196f79b9a996fc033daaeb0d7551c5689b367d3a8c5b56743c2eeba6528433071073b319bf76b7f80c6bd3

Download Submit
memory/3004-8-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/3004-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3004-0-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download