6c47b6c1e10754b709c637c001bc2b9e730fead0722373c2d4feb88243840272

Analysis

max time kernel
151s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 15:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-09_9be9eb31d7b02c5ec7c141d648c06252_cryptolocker.exe
Size

44KB
MD5

9be9eb31d7b02c5ec7c141d648c06252
SHA1

8c1fe350244989ad104cc2f415d9360a03d6fcc1
SHA256

6c47b6c1e10754b709c637c001bc2b9e730fead0722373c2d4feb88243840272
SHA512

deebf80940b86f23b4993e14b1169d6b20b3c7ebd8968a88f865e8dc86e1cfdd7a2507625504cee1481ea7ad464953ea3797f41fe38c817d80e122c4a31e5b2b
SSDEEP

768:bxNQIE0eBhkL2Fo1CCwgfjOg1tsJ6zeen754XcwxbFqRoN6Nh:bxNrC7kYo1Fxf3s05rwxbFvN6Nh

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000c0000000226fd-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	2024-03-09_9be9eb31d7b02c5ec7c141d648c06252_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3288	pissa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 3288	1424	2024-03-09_9be9eb31d7b02c5ec7c141d648c06252_cryptolocker.exe	89
PID 1424 wrote to memory of 3288	1424	2024-03-09_9be9eb31d7b02c5ec7c141d648c06252_cryptolocker.exe	89
PID 1424 wrote to memory of 3288	1424	2024-03-09_9be9eb31d7b02c5ec7c141d648c06252_cryptolocker.exe	89

C:\Users\Admin\AppData\Local\Temp\2024-03-09_9be9eb31d7b02c5ec7c141d648c06252_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-09_9be9eb31d7b02c5ec7c141d648c06252_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Users\Admin\AppData\Local\Temp\pissa.exe
  "C:\Users\Admin\AppData\Local\Temp\pissa.exe"
  2⤵
  - Executes dropped EXE
  PID:3288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\pissa.exe

Filesize
45KB

MD5
312a8bb12f29c373f39ea6c2b51f2856

SHA1
7595dbf3dddfba4b045515091429da5a22a90b22

SHA256
612639a55d697659ae817b883ad156e14e7a4a38758b89dcf5ce97cdcc4301a8

SHA512
14bbd704c68e39a382537d101085b49ce53d0d1520a331a161a0dac719551e93d69f8db2517e14b8af7d90074da53066887fd8eda5885b139950cd3fe6e8f4c0

Download Submit
memory/1424-0-0x0000000002110000-0x0000000002116000-memory.dmp

Filesize
24KB

Download
memory/1424-1-0x0000000002110000-0x0000000002116000-memory.dmp

Filesize
24KB

Download
memory/1424-2-0x00000000022C0000-0x00000000022C6000-memory.dmp

Filesize
24KB

Download
memory/3288-17-0x0000000002ED0000-0x0000000002ED6000-memory.dmp

Filesize
24KB

Download
memory/3288-20-0x0000000002D60000-0x0000000002D66000-memory.dmp

Filesize
24KB

Download