1894302d817386d759e6c5c0ec8513ddc4d713d182b8e9832ffc96ff26657af3

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 22:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-04_0691e8184a8a8090aeb6422a6b923ef0_cryptolocker.exe
Size

56KB
MD5

0691e8184a8a8090aeb6422a6b923ef0
SHA1

c7f5c7154f6264089d6285b61ec78c02a0d6ca07
SHA256

1894302d817386d759e6c5c0ec8513ddc4d713d182b8e9832ffc96ff26657af3
SHA512

ee62a2b1e3d4ce9f57b91abc3d1a2e982fa7e023bc2c0751e14114262943432dabf010084c9da3b3562d4d828e2ec268b4504fe92f5e164efa31c29129910b52
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszsbKY1xzpAIX6Ex5H:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7K

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2984	hurok.exe

Loads dropped DLL 1 IoCs

pid	Process
2364	2024-10-04_0691e8184a8a8090aeb6422a6b923ef0_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-04_0691e8184a8a8090aeb6422a6b923ef0_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hurok.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2364	2024-10-04_0691e8184a8a8090aeb6422a6b923ef0_cryptolocker.exe
2984	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2984	2364	2024-10-04_0691e8184a8a8090aeb6422a6b923ef0_cryptolocker.exe	31
PID 2364 wrote to memory of 2984	2364	2024-10-04_0691e8184a8a8090aeb6422a6b923ef0_cryptolocker.exe	31
PID 2364 wrote to memory of 2984	2364	2024-10-04_0691e8184a8a8090aeb6422a6b923ef0_cryptolocker.exe	31
PID 2364 wrote to memory of 2984	2364	2024-10-04_0691e8184a8a8090aeb6422a6b923ef0_cryptolocker.exe	31

C:\Users\Admin\AppData\Local\Temp\2024-10-04_0691e8184a8a8090aeb6422a6b923ef0_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-04_0691e8184a8a8090aeb6422a6b923ef0_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
56KB

MD5
bd6975d144b59495c809156cd7468640

SHA1
a20612e7a623c0684d999541fd8288f67f601be9

SHA256
aad5794ad76e6d6874d3bf9889f41c426a5a3b6bab7af5f059d8bbab0a3cb5df

SHA512
2acf7332e1f1d356492db23d7e1fa9a1ca7130ac27f4b45446be68d755e3f5aa777ee48ab75b4d375f5800e313fa05eee5c72ee8f173cd27b68f78455ae09e4a

Download Submit
memory/2364-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2364-0-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2364-8-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download