4809d5145bf31911a8a742b04e02214a644015d1ab449ab01782df399c239a8a

Analysis

max time kernel
183s
max time network
207s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 15:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-03_415f5bebf7d3920bf2a4544c165b5f1d_cryptolocker.exe
Size

34KB
MD5

415f5bebf7d3920bf2a4544c165b5f1d
SHA1

a7facb80290fea9a6e0409828d88aae42249379c
SHA256

4809d5145bf31911a8a742b04e02214a644015d1ab449ab01782df399c239a8a
SHA512

463d484773441582ff8bf0dc3d222306d7c35288725bab5e449839f79b422e73be6f02f82e4129facaffc72d2bab2b8aa23362f703b6dcd3acf3ec675c30ebb2
SSDEEP

768:bxNQIE0eBhkL2Fo1CCwgfjOg1tsJ6zeen754I:bxNrC7kYo1Fxf3s059

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2568	pissa.exe

Loads dropped DLL 1 IoCs

pid	Process
2852	2024-01-03_415f5bebf7d3920bf2a4544c165b5f1d_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 2568	2852	2024-01-03_415f5bebf7d3920bf2a4544c165b5f1d_cryptolocker.exe	29
PID 2852 wrote to memory of 2568	2852	2024-01-03_415f5bebf7d3920bf2a4544c165b5f1d_cryptolocker.exe	29
PID 2852 wrote to memory of 2568	2852	2024-01-03_415f5bebf7d3920bf2a4544c165b5f1d_cryptolocker.exe	29
PID 2852 wrote to memory of 2568	2852	2024-01-03_415f5bebf7d3920bf2a4544c165b5f1d_cryptolocker.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-01-03_415f5bebf7d3920bf2a4544c165b5f1d_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-03_415f5bebf7d3920bf2a4544c165b5f1d_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Users\Admin\AppData\Local\Temp\pissa.exe
  "C:\Users\Admin\AppData\Local\Temp\pissa.exe"
  2⤵
  - Executes dropped EXE
  PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\pissa.exe

Filesize
34KB

MD5
a51d3913b1baaf9a3cb6aba020150986

SHA1
30d10700fc44cb95f44d73cc057d1d668ac64f7c

SHA256
003f448d943afef743673a6c95c5169edb30743ce1333c35f7659edd61b09d46

SHA512
8037ba807bf1188ca73aae52c59a6fcb6171527a68d1d5594307f2457a133851e259cf3484d8f953fa57a6e73bf1b469aae935ce95e4ab158862ff4f12ced90a

Download Submit
memory/2568-19-0x00000000007F0000-0x00000000007F6000-memory.dmp

Filesize
24KB

Download
memory/2568-15-0x0000000000810000-0x0000000000816000-memory.dmp

Filesize
24KB

Download
memory/2852-0-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2852-2-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2852-1-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download