710db6af8f5c9c4b1893a84938dd487ddde4cab992c8e99b265d4d630dbdd4b5

Analysis

max time kernel
144s
max time network
152s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-10-2024 05:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-05_a72089e644dab8a8097e17ca7375e079_cryptolocker.exe
Size

70KB
MD5

a72089e644dab8a8097e17ca7375e079
SHA1

a7b210a6d3664b59a5c9acc110c167c381cfd4eb
SHA256

710db6af8f5c9c4b1893a84938dd487ddde4cab992c8e99b265d4d630dbdd4b5
SHA512

ef58856224ad321e81560f5f83cf142dcea93b9bcc4d69677b2df5b715658b20ba1d6169130617747a28e742416461a1c3f5370cdd04f7c9a10511620164bda5
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszudnYTjipvF293vaRLEc:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7U

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1704	hurok.exe

Loads dropped DLL 1 IoCs

pid	Process
2532	2024-10-05_a72089e644dab8a8097e17ca7375e079_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-05_a72089e644dab8a8097e17ca7375e079_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hurok.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2532	2024-10-05_a72089e644dab8a8097e17ca7375e079_cryptolocker.exe
1704	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 1704	2532	2024-10-05_a72089e644dab8a8097e17ca7375e079_cryptolocker.exe	30
PID 2532 wrote to memory of 1704	2532	2024-10-05_a72089e644dab8a8097e17ca7375e079_cryptolocker.exe	30
PID 2532 wrote to memory of 1704	2532	2024-10-05_a72089e644dab8a8097e17ca7375e079_cryptolocker.exe	30
PID 2532 wrote to memory of 1704	2532	2024-10-05_a72089e644dab8a8097e17ca7375e079_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-10-05_a72089e644dab8a8097e17ca7375e079_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-05_a72089e644dab8a8097e17ca7375e079_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  PID:1704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
70KB

MD5
3042c1011c3b860a0661fac9b36db6b9

SHA1
3302729d2f1cf5f6e2ba7ee280f4cf79035d4afd

SHA256
0f6771a26ef36bf2a5205accb5fe0080008f1fe11cd8e0ca66676a827ee9ce5e

SHA512
7b6667c6e3d0042fab0ee7ac9351de5c1ba5d58de2c5a9813c44709eb48a9cdb8d6e88bd42c9f8c2081262bb0e9eada4e488f66a4ca085ebf064c405ef41c962

Download Submit
memory/1704-23-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2532-8-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/2532-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2532-0-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download