79be3b707f3755f2b9f3a8ddc543433814972aa19f05611348cf883f605ab746

Analysis

max time kernel
143s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04-02-2024 01:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-04_07a4177d0f2a53daf3de489ef9ac7327_cryptolocker.exe
Size

37KB
MD5

07a4177d0f2a53daf3de489ef9ac7327
SHA1

b44923b4412f726ed9d4a583bfcbe1b60286d5c0
SHA256

79be3b707f3755f2b9f3a8ddc543433814972aa19f05611348cf883f605ab746
SHA512

f67ca741d5859543a64577a4a73d513b833b25e81c15a440fcb6cd64daa3b49b20c01ed00538f44319099228903a2cb235ed534f53d34ca7105d49b6f0e23274
SSDEEP

768:bxNQIE0eBhkL2Fo1CCwgfjOg1tsJ6zeen7JEgx3Ov:bxNrC7kYo1Fxf3s06gYv

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000a00000001224a-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
1212	pissa.exe

Loads dropped DLL 1 IoCs

pid	Process
2288	2024-02-04_07a4177d0f2a53daf3de489ef9ac7327_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 1212	2288	2024-02-04_07a4177d0f2a53daf3de489ef9ac7327_cryptolocker.exe	28
PID 2288 wrote to memory of 1212	2288	2024-02-04_07a4177d0f2a53daf3de489ef9ac7327_cryptolocker.exe	28
PID 2288 wrote to memory of 1212	2288	2024-02-04_07a4177d0f2a53daf3de489ef9ac7327_cryptolocker.exe	28
PID 2288 wrote to memory of 1212	2288	2024-02-04_07a4177d0f2a53daf3de489ef9ac7327_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-04_07a4177d0f2a53daf3de489ef9ac7327_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-04_07a4177d0f2a53daf3de489ef9ac7327_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Users\Admin\AppData\Local\Temp\pissa.exe
  "C:\Users\Admin\AppData\Local\Temp\pissa.exe"
  2⤵
  - Executes dropped EXE
  PID:1212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\pissa.exe

Filesize
37KB

MD5
2f7f4194126baf148b2b4d02f6776ec4

SHA1
0dc12cbbf32ff63a23513d25d1314845841068d3

SHA256
b334733f9ac7fa12e4edc3d0e0b5beee0621cb978c449ba10fe95a48ddfc1e45

SHA512
7fdf1f69006220f5da066fbf0a725c3d0c19ea43e04349e00297831aa1f9c0b662c5abb4a909fc48ebbf3cd8f0cfcf7d69f87bef1d0093c887f453b4358238ff

Download Submit
memory/1212-15-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/2288-0-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/2288-1-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2288-2-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download