8698cb00e56e2ab1e856617b682b82445ca5652f42213ad1581364c45aa6aeee

Analysis

max time kernel
150s
max time network
156s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 05:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-20_7a710599a966b08d35ceb2200dd80392_cryptolocker.exe
Size

69KB
MD5

7a710599a966b08d35ceb2200dd80392
SHA1

6d4a9d49064e1446c1f79619ab5130f365fcfb84
SHA256

8698cb00e56e2ab1e856617b682b82445ca5652f42213ad1581364c45aa6aeee
SHA512

e4b4afa91fe7e633398d505dd458e94aa8bb2a5c768f23388678104f58093c01d47291fa6497605483c2d0c8081ef07adf24461ad8d06ce02de16e618880afab
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszudnYTjipvF293vaRLEg:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7I

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2908	hurok.exe

Loads dropped DLL 1 IoCs

pid	Process
1232	2024-11-20_7a710599a966b08d35ceb2200dd80392_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-20_7a710599a966b08d35ceb2200dd80392_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hurok.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1232	2024-11-20_7a710599a966b08d35ceb2200dd80392_cryptolocker.exe
2908	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 2908	1232	2024-11-20_7a710599a966b08d35ceb2200dd80392_cryptolocker.exe	30
PID 1232 wrote to memory of 2908	1232	2024-11-20_7a710599a966b08d35ceb2200dd80392_cryptolocker.exe	30
PID 1232 wrote to memory of 2908	1232	2024-11-20_7a710599a966b08d35ceb2200dd80392_cryptolocker.exe	30
PID 1232 wrote to memory of 2908	1232	2024-11-20_7a710599a966b08d35ceb2200dd80392_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-11-20_7a710599a966b08d35ceb2200dd80392_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-20_7a710599a966b08d35ceb2200dd80392_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
69KB

MD5
087ce26564f50509ab128bbf60437ead

SHA1
a3a87b75c67687ae6bd008a11699ee08fc7701a7

SHA256
322253ff5c2187f1d935bc83ea97614460ffb04be18cd7d235ca0abf8f5e343b

SHA512
a7e69d85d1041d93983bf97b3adbb86b748887f36cd02dc104baf70c91604dbbef203079e241319dc58ff17d6e955edfb811a9f2c61d3b0735aac778162eba23

Download Submit
memory/1232-0-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/1232-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1232-8-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download