96d5dfaddac8c56efcd6adb811ae291bb0ab33772eac3e6b2ca3a74dd3daa214

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2024 01:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-29_f33961c29549adc2ddc2088275edb8d8_cryptolocker.exe
Size

36KB
MD5

f33961c29549adc2ddc2088275edb8d8
SHA1

ec18714b1fad8960b37a6d4b4ad528fafb86302a
SHA256

96d5dfaddac8c56efcd6adb811ae291bb0ab33772eac3e6b2ca3a74dd3daa214
SHA512

7c4462789e38fab85e873235de9062fc5d4b2c292b6e00389acc6bb97c00bc61905549046dbf7b96b4f1c5a9f49b11c2dc6b299c3286cdd998e06539ad683f33
SSDEEP

768:bxNQIE0eBhkL2Fo1CCwgfjOg1tsJ6zeen7JEgx3A:bxNrC7kYo1Fxf3s06gS

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000700000002321e-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation	2024-01-29_f33961c29549adc2ddc2088275edb8d8_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3260	pissa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 3260	4968	2024-01-29_f33961c29549adc2ddc2088275edb8d8_cryptolocker.exe	82
PID 4968 wrote to memory of 3260	4968	2024-01-29_f33961c29549adc2ddc2088275edb8d8_cryptolocker.exe	82
PID 4968 wrote to memory of 3260	4968	2024-01-29_f33961c29549adc2ddc2088275edb8d8_cryptolocker.exe	82

C:\Users\Admin\AppData\Local\Temp\2024-01-29_f33961c29549adc2ddc2088275edb8d8_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-29_f33961c29549adc2ddc2088275edb8d8_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Users\Admin\AppData\Local\Temp\pissa.exe
  "C:\Users\Admin\AppData\Local\Temp\pissa.exe"
  2⤵
  - Executes dropped EXE
  PID:3260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\pissa.exe

Filesize
36KB

MD5
ea1585d46c5e17d85903431f88a6284b

SHA1
0080a6710155cde1666d81da9e450fd132bcebd9

SHA256
189bf96446d5449a1490da2744d6f6aba9b2c3b338657d312c71b335cf8fc054

SHA512
864405ae404813f6b60ca79e69c68a943f7b3a9622a0c347e5f64a8657365f0af9c7e871081dd38c14691c960bb8635127d8db321d803b09d9786f3b1939e570

Download Submit
memory/3260-18-0x0000000002D60000-0x0000000002D66000-memory.dmp

Filesize
24KB

Download
memory/3260-17-0x0000000003010000-0x0000000003016000-memory.dmp

Filesize
24KB

Download
memory/4968-0-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/4968-1-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/4968-2-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download