8653f5bc789b9a26bbf5b13ac8e3eb3c6465eaee9a6e601a740af1bca6802b94

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
18/02/2024, 17:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-18_23ad2587b8945dd7f9d3c98e31f97765_cryptolocker.exe
Size

37KB
MD5

23ad2587b8945dd7f9d3c98e31f97765
SHA1

f2f60deb6d0b1f151520d3ddeb9474f619ca1a2f
SHA256

8653f5bc789b9a26bbf5b13ac8e3eb3c6465eaee9a6e601a740af1bca6802b94
SHA512

6868305b67021f0fe5a8068c24879a9cbc213547f17d6dd3fe211c207ba21cf8527b24abcc2a071439cbb24bec0db94c535af60fff7d781d2b65d8b0d5c3c4ad
SSDEEP

768:bxNQIE0eBhkL2Fo1CCwgfjOg1tsJ6zeen7JEgx3Otjxa:bxNrC7kYo1Fxf3s06gYtjxa

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000a00000001393e-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2160	pissa.exe

Loads dropped DLL 1 IoCs

pid	Process
1704	2024-02-18_23ad2587b8945dd7f9d3c98e31f97765_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2160	1704	2024-02-18_23ad2587b8945dd7f9d3c98e31f97765_cryptolocker.exe	28
PID 1704 wrote to memory of 2160	1704	2024-02-18_23ad2587b8945dd7f9d3c98e31f97765_cryptolocker.exe	28
PID 1704 wrote to memory of 2160	1704	2024-02-18_23ad2587b8945dd7f9d3c98e31f97765_cryptolocker.exe	28
PID 1704 wrote to memory of 2160	1704	2024-02-18_23ad2587b8945dd7f9d3c98e31f97765_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-18_23ad2587b8945dd7f9d3c98e31f97765_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-18_23ad2587b8945dd7f9d3c98e31f97765_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Users\Admin\AppData\Local\Temp\pissa.exe
  "C:\Users\Admin\AppData\Local\Temp\pissa.exe"
  2⤵
  - Executes dropped EXE
  PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\pissa.exe

Filesize
37KB

MD5
0a3d5885696c97f9afdae1c9e2499feb

SHA1
dc2741215ba700d4e68e44b35e2aa61145a1a7fb

SHA256
3c370b7afed336bcb085638d0ed0ed261a67b4750337acba43fe66c3cbf067be

SHA512
e9163e2aa8a32cf69085bf6aab1630706e00cfdf612ea9a9af42741cb3ee4b32e6bdcddfffb927f7e5465f667953652497c4c7733c5091539bc0126e5514f61a

Download Submit
memory/1704-0-0x0000000001C20000-0x0000000001C26000-memory.dmp

Filesize
24KB

Download
memory/1704-1-0x0000000001C30000-0x0000000001C36000-memory.dmp

Filesize
24KB

Download
memory/1704-2-0x0000000001C20000-0x0000000001C26000-memory.dmp

Filesize
24KB

Download
memory/2160-16-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2160-15-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download