0c04f35eee0c3c46664c9f617cd4d935e7bc121e88c3f3c5c1b03aa59ce1b3a0

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/02/2024, 09:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-02_a4d34315da6fe6bbb7c18765038c8e7f_cryptolocker.exe
Size

42KB
MD5

a4d34315da6fe6bbb7c18765038c8e7f
SHA1

1a258da02f18a2ca9812a056f5f6056210cccdc4
SHA256

0c04f35eee0c3c46664c9f617cd4d935e7bc121e88c3f3c5c1b03aa59ce1b3a0
SHA512

1157edbea00e2021240cbb078076a8276a5fb6bf8889437e67fc617639c2b8352deefe92c121309cf1c7a3c85e534be9c56ee0b37c1dcc7a14fbfdbc0a5ad088
SSDEEP

768:bxNQIE0eBhkL2Fo1CCwgfjOg1tsJ6zeen754XcwxbFp1Yvb9o:bxNrC7kYo1Fxf3s05rwxbF7YvbG

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b000000012234-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2004	pissa.exe

Loads dropped DLL 1 IoCs

pid	Process
1888	2024-02-02_a4d34315da6fe6bbb7c18765038c8e7f_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 2004	1888	2024-02-02_a4d34315da6fe6bbb7c18765038c8e7f_cryptolocker.exe	28
PID 1888 wrote to memory of 2004	1888	2024-02-02_a4d34315da6fe6bbb7c18765038c8e7f_cryptolocker.exe	28
PID 1888 wrote to memory of 2004	1888	2024-02-02_a4d34315da6fe6bbb7c18765038c8e7f_cryptolocker.exe	28
PID 1888 wrote to memory of 2004	1888	2024-02-02_a4d34315da6fe6bbb7c18765038c8e7f_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-02_a4d34315da6fe6bbb7c18765038c8e7f_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-02_a4d34315da6fe6bbb7c18765038c8e7f_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Users\Admin\AppData\Local\Temp\pissa.exe
  "C:\Users\Admin\AppData\Local\Temp\pissa.exe"
  2⤵
  - Executes dropped EXE
  PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\pissa.exe

Filesize
42KB

MD5
ee8bb053e64482322b9d1d5cb419d753

SHA1
1141478099ffccfd632bfbe257c21203c7effcfd

SHA256
e34fbc8779c9da96472cf504e5cd6b90514026d758bab3b3c5354c6ec1da9c51

SHA512
89ea591ee4774dea43ece8734cc9ed166e726029f9a890c1defb5bc1e45951a733cc40962504b40477ba5856337d8e14e4100b9f79df2f1eed0c0da24d6ec520

Download Submit
memory/1888-0-0x0000000000850000-0x0000000000856000-memory.dmp

Filesize
24KB

Download
memory/1888-1-0x0000000001CF0000-0x0000000001CF6000-memory.dmp

Filesize
24KB

Download
memory/1888-3-0x0000000000850000-0x0000000000856000-memory.dmp

Filesize
24KB

Download
memory/2004-16-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download
memory/2004-15-0x0000000000430000-0x0000000000436000-memory.dmp

Filesize
24KB

Download