6c47b6c1e10754b709c637c001bc2b9e730fead0722373c2d4feb88243840272

Analysis

max time kernel
147s
max time network
157s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-03-2024 15:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-09_9be9eb31d7b02c5ec7c141d648c06252_cryptolocker.exe
Size

44KB
MD5

9be9eb31d7b02c5ec7c141d648c06252
SHA1

8c1fe350244989ad104cc2f415d9360a03d6fcc1
SHA256

6c47b6c1e10754b709c637c001bc2b9e730fead0722373c2d4feb88243840272
SHA512

deebf80940b86f23b4993e14b1169d6b20b3c7ebd8968a88f865e8dc86e1cfdd7a2507625504cee1481ea7ad464953ea3797f41fe38c817d80e122c4a31e5b2b
SSDEEP

768:bxNQIE0eBhkL2Fo1CCwgfjOg1tsJ6zeen754XcwxbFqRoN6Nh:bxNrC7kYo1Fxf3s05rwxbFvN6Nh

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000800000001222d-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2552	pissa.exe

Loads dropped DLL 1 IoCs

pid	Process
2164	2024-03-09_9be9eb31d7b02c5ec7c141d648c06252_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2552	2164	2024-03-09_9be9eb31d7b02c5ec7c141d648c06252_cryptolocker.exe	28
PID 2164 wrote to memory of 2552	2164	2024-03-09_9be9eb31d7b02c5ec7c141d648c06252_cryptolocker.exe	28
PID 2164 wrote to memory of 2552	2164	2024-03-09_9be9eb31d7b02c5ec7c141d648c06252_cryptolocker.exe	28
PID 2164 wrote to memory of 2552	2164	2024-03-09_9be9eb31d7b02c5ec7c141d648c06252_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-09_9be9eb31d7b02c5ec7c141d648c06252_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-09_9be9eb31d7b02c5ec7c141d648c06252_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Users\Admin\AppData\Local\Temp\pissa.exe
  "C:\Users\Admin\AppData\Local\Temp\pissa.exe"
  2⤵
  - Executes dropped EXE
  PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\pissa.exe

Filesize
45KB

MD5
312a8bb12f29c373f39ea6c2b51f2856

SHA1
7595dbf3dddfba4b045515091429da5a22a90b22

SHA256
612639a55d697659ae817b883ad156e14e7a4a38758b89dcf5ce97cdcc4301a8

SHA512
14bbd704c68e39a382537d101085b49ce53d0d1520a331a161a0dac719551e93d69f8db2517e14b8af7d90074da53066887fd8eda5885b139950cd3fe6e8f4c0

Download Submit
memory/2164-0-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2164-2-0x0000000001BC0000-0x0000000001BC6000-memory.dmp

Filesize
24KB

Download
memory/2164-1-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2552-16-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2552-15-0x0000000000350000-0x0000000000356000-memory.dmp

Filesize
24KB

Download