5115dc1e482e5faf1f2bab7a0edba0e4be111c10454ec9a3a560283e164971af

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-19_0e35ef4318e546b9a0f4063051acfb47_cryptolocker.exe
Size

57KB
MD5

0e35ef4318e546b9a0f4063051acfb47
SHA1

e103d0953570fbc98c1fce855552f4a5a461a639
SHA256

5115dc1e482e5faf1f2bab7a0edba0e4be111c10454ec9a3a560283e164971af
SHA512

ef03daf750d16eef6e70e1e0f600478490ad5ed218b41766ef4354399aa06432b806eb68d8085163e0f4abcee0b689f0fec98f13011fe568b57dbff09720b6e2
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszsbKY1xzpAIX6EcG:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7I

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1808	hurok.exe

Loads dropped DLL 1 IoCs

pid	Process
1880	2024-09-19_0e35ef4318e546b9a0f4063051acfb47_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-19_0e35ef4318e546b9a0f4063051acfb47_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hurok.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1880	2024-09-19_0e35ef4318e546b9a0f4063051acfb47_cryptolocker.exe
1808	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 1808	1880	2024-09-19_0e35ef4318e546b9a0f4063051acfb47_cryptolocker.exe	30
PID 1880 wrote to memory of 1808	1880	2024-09-19_0e35ef4318e546b9a0f4063051acfb47_cryptolocker.exe	30
PID 1880 wrote to memory of 1808	1880	2024-09-19_0e35ef4318e546b9a0f4063051acfb47_cryptolocker.exe	30
PID 1880 wrote to memory of 1808	1880	2024-09-19_0e35ef4318e546b9a0f4063051acfb47_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-09-19_0e35ef4318e546b9a0f4063051acfb47_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-19_0e35ef4318e546b9a0f4063051acfb47_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  PID:1808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
57KB

MD5
167b8a79787ddc959d4d22015a9e5c33

SHA1
40505b8123af38b7ad09d38d0ac85dcdbfbf3071

SHA256
3ccea342bbfdaeab6e1a25baeb4df6eb2b0e5e296246f51e4160f85cbeefd5d8

SHA512
74a7c35f1d84ee66b0b33031121359aeeb7b733270ef855e1380f775b6635ddec98c08c0e04d56ce3b4466b0316297241329f5b2c969435133fa9b1faa1a78fd

Download Submit
memory/1808-23-0x00000000003D0000-0x00000000003D6000-memory.dmp

Filesize
24KB

Download
memory/1880-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1880-8-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/1880-0-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download