0f006ea21c4b8a1734ea9bfb32299921390548c162fcd4346b201927a899f870

Analysis

max time kernel
147s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 05:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-01-11_0cbd78055c10631148aceb016d328b2d_cryptolocker.exe
Size

39KB
MD5

0cbd78055c10631148aceb016d328b2d
SHA1

1926172040c8dfdba11623e7ffa290c7f621fa8a
SHA256

0f006ea21c4b8a1734ea9bfb32299921390548c162fcd4346b201927a899f870
SHA512

d37703b68b15d56090dfe8a6485b733453d8ebcaee4c52dcff097cc3dc29e6525f721a47deadd2f44c058ea4e3a75f5c2d936230cade6b8c7cf21d040ea80a7d
SSDEEP

768:bxNQIE0eBhkL2Fo1CCwgfjOg1tsJ6zeen754XcwxbFI:bxNrC7kYo1Fxf3s05rwxbFI

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2704	pissa.exe

Loads dropped DLL 1 IoCs

pid	Process
2512	2024-01-11_0cbd78055c10631148aceb016d328b2d_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2704	2512	2024-01-11_0cbd78055c10631148aceb016d328b2d_cryptolocker.exe	24
PID 2512 wrote to memory of 2704	2512	2024-01-11_0cbd78055c10631148aceb016d328b2d_cryptolocker.exe	24
PID 2512 wrote to memory of 2704	2512	2024-01-11_0cbd78055c10631148aceb016d328b2d_cryptolocker.exe	24
PID 2512 wrote to memory of 2704	2512	2024-01-11_0cbd78055c10631148aceb016d328b2d_cryptolocker.exe	24

C:\Users\Admin\AppData\Local\Temp\2024-01-11_0cbd78055c10631148aceb016d328b2d_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-11_0cbd78055c10631148aceb016d328b2d_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Users\Admin\AppData\Local\Temp\pissa.exe
  "C:\Users\Admin\AppData\Local\Temp\pissa.exe"
  2⤵
  - Executes dropped EXE
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\pissa.exe

Filesize
39KB

MD5
d0e721b1efba292f81835906b0703a4d

SHA1
f77e44bd5456f41ebfa6953dc97f8d5b0e9f8ef8

SHA256
cec006929d803ad697b676ebb3b73c4abb53751f7d5030080f049fd592b92a90

SHA512
ca7dc51a5ebda0e58abed2f02dbcf9f95f4ddccd72b0ea5d5f32850f22a5c0598a92adde26372499ddacec15d8ce7f1147c1eb8d4c82c9deb7572c0d5214a6e1

Download Submit
memory/2512-8-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/2512-1-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/2512-0-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/2704-22-0x0000000001CC0000-0x0000000001CC6000-memory.dmp

Filesize
24KB

Download
memory/2704-15-0x0000000001CE0000-0x0000000001CE6000-memory.dmp

Filesize
24KB

Download