fb3fa5b850ef42733cee0ef7a28737626906031e475b1cde913eeabf4e01fb33

Analysis

max time kernel
139s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 05:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-05_42258c1540431d9364370ab3ebec6ac2_cryptolocker.exe
Size

40KB
MD5

42258c1540431d9364370ab3ebec6ac2
SHA1

cb6db71b19a93e99b80f5b91f6f13ae3f5304a6d
SHA256

fb3fa5b850ef42733cee0ef7a28737626906031e475b1cde913eeabf4e01fb33
SHA512

a794e5d22d90e35cff5039b57536c5dfc942b3d121a1ba17f5f5cc088572b93d9869f116edc82ddc31f1b333d6ad38c4a19a51eee554ecfbc18ee7588872e33c
SSDEEP

768:bxNQIE0eBhkL2Fo1CCwgfjOg1tsJ6zeen754XcwxbFoC:bxNrC7kYo1Fxf3s05rwxbFJ

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b00000001223a-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2976	pissa.exe

Loads dropped DLL 1 IoCs

pid	Process
2076	2024-03-05_42258c1540431d9364370ab3ebec6ac2_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2976	2076	2024-03-05_42258c1540431d9364370ab3ebec6ac2_cryptolocker.exe	28
PID 2076 wrote to memory of 2976	2076	2024-03-05_42258c1540431d9364370ab3ebec6ac2_cryptolocker.exe	28
PID 2076 wrote to memory of 2976	2076	2024-03-05_42258c1540431d9364370ab3ebec6ac2_cryptolocker.exe	28
PID 2076 wrote to memory of 2976	2076	2024-03-05_42258c1540431d9364370ab3ebec6ac2_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-05_42258c1540431d9364370ab3ebec6ac2_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-05_42258c1540431d9364370ab3ebec6ac2_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Users\Admin\AppData\Local\Temp\pissa.exe
  "C:\Users\Admin\AppData\Local\Temp\pissa.exe"
  2⤵
  - Executes dropped EXE
  PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\pissa.exe

Filesize
40KB

MD5
bf6e1d427ce95876ce32c29d6fea9097

SHA1
6a0d0b9e4373a5669fb738a48b4d7557b3c92da9

SHA256
26dc322cd36d601e2cfc8eba7a1274c6e26a86e40c94cc82c3c9973b19c4a078

SHA512
1f9e4371a926389f6b48eb65fde6a890b2e06c2ab1a940a8774e9dd0d5f0e0d80bc320176fe739e6ec3d8ef21fa396b51e72e0505b35f968106289b2e29b19b5

Download Submit
memory/2076-0-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2076-1-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/2076-2-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2976-15-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download
memory/2976-17-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download