743b6028bb3b36493fcbf349685156d2a88a86d03008940908bdf606ab64c980

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-10-2024 06:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-09_4c2dca53dcb8d68dac6a5a9c771c9622_cryptolocker.exe
Size

48KB
MD5

4c2dca53dcb8d68dac6a5a9c771c9622
SHA1

e97659c66c89c1955193f9de8594388b53a8c3b7
SHA256

743b6028bb3b36493fcbf349685156d2a88a86d03008940908bdf606ab64c980
SHA512

3bdde099a734f0bb84472f2f2d45e8415bf1819ca31210f694a7e521cc344dd19a9c697c228fdc04c6dac7cfbe951737f73cb3b32642f08411d89901b0d9fe29
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszsbKY1x5hjatH:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7z

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2312	hurok.exe

Loads dropped DLL 1 IoCs

pid	Process
1416	2024-10-09_4c2dca53dcb8d68dac6a5a9c771c9622_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-09_4c2dca53dcb8d68dac6a5a9c771c9622_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hurok.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1416	2024-10-09_4c2dca53dcb8d68dac6a5a9c771c9622_cryptolocker.exe
2312	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 2312	1416	2024-10-09_4c2dca53dcb8d68dac6a5a9c771c9622_cryptolocker.exe	31
PID 1416 wrote to memory of 2312	1416	2024-10-09_4c2dca53dcb8d68dac6a5a9c771c9622_cryptolocker.exe	31
PID 1416 wrote to memory of 2312	1416	2024-10-09_4c2dca53dcb8d68dac6a5a9c771c9622_cryptolocker.exe	31
PID 1416 wrote to memory of 2312	1416	2024-10-09_4c2dca53dcb8d68dac6a5a9c771c9622_cryptolocker.exe	31

C:\Users\Admin\AppData\Local\Temp\2024-10-09_4c2dca53dcb8d68dac6a5a9c771c9622_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-09_4c2dca53dcb8d68dac6a5a9c771c9622_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
48KB

MD5
cb157d43479464207113ad82d85ed398

SHA1
b45ae0f6c115c47c692e97ed012c25c814287a0e

SHA256
1c00c6fc80e739c7f5ef6b1568f7a921592e57bd90ca23de804e1d6bff9bdf9d

SHA512
dae08e45a779aba6dc3297aa680f573673095396293257a01084ca8634a2c026d534e4ad1dd081cc54e3cdfe41e34bb816a044e68062314cb6d719536e4f48cf

Download Submit
memory/1416-0-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/1416-8-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/1416-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2312-23-0x00000000003C0000-0x00000000003C6000-memory.dmp

Filesize
24KB

Download