16cfa0daf6de553ff3751dac0a97bfc272169a8ca23a031cf23597a3d045ffbd

Analysis

max time kernel
144s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
02/02/2024, 22:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-02_04b77b911d33d952b8e33c2c7a999e26_cryptolocker.exe
Size

36KB
MD5

04b77b911d33d952b8e33c2c7a999e26
SHA1

55175735a2a199a84c5a972ff65e53deafa1ee2e
SHA256

16cfa0daf6de553ff3751dac0a97bfc272169a8ca23a031cf23597a3d045ffbd
SHA512

2c14696479ba0e1b7de0d8e9b7001f0e1c546dc036eab6d49578aa96acd164c3793e78e7a48f7bbce7a48465026a539939f734078ad22857eb3eadff4ccc9c09
SSDEEP

768:bxNQIE0eBhkL2Fo1CCwgfjOg1tsJ6zeen7JEgx3OV:bxNrC7kYo1Fxf3s06gYV

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000700000002320d-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	2024-02-02_04b77b911d33d952b8e33c2c7a999e26_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
4980	pissa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 4980	4032	2024-02-02_04b77b911d33d952b8e33c2c7a999e26_cryptolocker.exe	86
PID 4032 wrote to memory of 4980	4032	2024-02-02_04b77b911d33d952b8e33c2c7a999e26_cryptolocker.exe	86
PID 4032 wrote to memory of 4980	4032	2024-02-02_04b77b911d33d952b8e33c2c7a999e26_cryptolocker.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-02-02_04b77b911d33d952b8e33c2c7a999e26_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-02_04b77b911d33d952b8e33c2c7a999e26_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Users\Admin\AppData\Local\Temp\pissa.exe
  "C:\Users\Admin\AppData\Local\Temp\pissa.exe"
  2⤵
  - Executes dropped EXE
  PID:4980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\pissa.exe

Filesize
37KB

MD5
bdaf42c5164ae28d79fc7c206bd8c72d

SHA1
9fa8218c4912ffe4a2956f9cb9d67bab8e729f2e

SHA256
7d3be1114560e52128330c9486436aed2f887183bc90390870d121cd9b529984

SHA512
c51bf1ea8d2a1b8ef63b64f62921272e5126c220a8f693c3fa18dffabdf2adaf312fe42c81e41db3347d9daceb3d422554e80d771ffae2d85c0c1c37d2b9a790

Download Submit
memory/4032-0-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/4032-2-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download
memory/4032-1-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/4980-17-0x0000000003010000-0x0000000003016000-memory.dmp

Filesize
24KB

Download
memory/4980-23-0x0000000000610000-0x0000000000616000-memory.dmp

Filesize
24KB

Download