a762555ec28dde00a9cd2c763589709e240555e2bd4aabb9f4e14d67a9919bc0

Analysis

max time kernel
145s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 15:56

Target

2024-01-25_fdb5699a52f5c2de8c9c0d445ec47a56_cryptolocker.exe
Size

42KB
MD5

fdb5699a52f5c2de8c9c0d445ec47a56
SHA1

39692bfef655fdc3a46b53788316207d73e81fb4
SHA256

a762555ec28dde00a9cd2c763589709e240555e2bd4aabb9f4e14d67a9919bc0
SHA512

1b3e45181d811b068d4d8dac27638ddeab0308b27f7e83be5954f62e8663a458ecacebd9e7ea9dfd1ab26e6b1ce24c275bc61c60ae50e0f8bc0d09ad8b311588
SSDEEP

768:bxNQIE0eBhkL2Fo1CCwgfjOg1tsJ6zeen754XcwxbFqL:bxNrC7kYo1Fxf3s05rwxbFG

Score

9^/10

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\pissa.exe	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

Processes:

pissa.exe

pid process

2380 pissa.exe
Loads dropped DLL 1 IoCs

Processes:

2024-01-25_fdb5699a52f5c2de8c9c0d445ec47a56_cryptolocker.exe

pid process

2332 2024-01-25_fdb5699a52f5c2de8c9c0d445ec47a56_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2380	pissa.exe

pid	process
2332	2024-01-25_fdb5699a52f5c2de8c9c0d445ec47a56_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-01-25_fdb5699a52f5c2de8c9c0d445ec47a56_cryptolocker.exe

description	pid	process	target process
PID 2332 wrote to memory of 2380	2332	2024-01-25_fdb5699a52f5c2de8c9c0d445ec47a56_cryptolocker.exe	pissa.exe
PID 2332 wrote to memory of 2380	2332	2024-01-25_fdb5699a52f5c2de8c9c0d445ec47a56_cryptolocker.exe	pissa.exe
PID 2332 wrote to memory of 2380	2332	2024-01-25_fdb5699a52f5c2de8c9c0d445ec47a56_cryptolocker.exe	pissa.exe
PID 2332 wrote to memory of 2380	2332	2024-01-25_fdb5699a52f5c2de8c9c0d445ec47a56_cryptolocker.exe	pissa.exe

C:\Users\Admin\AppData\Local\Temp\pissa.exe
"C:\Users\Admin\AppData\Local\Temp\pissa.exe"
2⤵
- Executes dropped EXE
PID:2380

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\pissa.exe
Filesize
42KB

MD5
a86915e479cbe0eacaef2661864f44e8

SHA1
f0695cc083484e606e7b268e520c56878a14e295

SHA256
11cd0aa44b4f72a6b24936ad901af009584f2ff508b8332378203c3668e45268

SHA512
f8fa0065504af42b3a0bd24c0de09d51eb67f0a5b992ee343501c59eddb350d5a3f3a588087d32491e80986fe4332dbba5c47e67e0af8f47812eea2c9a97b2c5

Download Submit
memory/2332-0-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/2332-1-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2332-8-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/2380-16-0x00000000002A0000-0x00000000002A6000-memory.dmp

Filesize
24KB

Download
memory/2380-15-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download