Analysis

  • max time kernel
    146s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    11/03/2024, 14:54

General

  • Target

    2024-03-11_f9976bb0ea78e0f7a407ba262993c8e0_cryptolocker.exe

  • Size

    38KB

  • MD5

    f9976bb0ea78e0f7a407ba262993c8e0

  • SHA1

    2899b0fe93e1be9182847b75acf59bdbde4c70a8

  • SHA256

    ee63c12512371bbd3af6aa445de2ced241868392f71373c4d900bc04683bbc23

  • SHA512

    40e7450ba588bc16dd76a2c17068d1abc5c8ffd044eacac56ae7c43b5bb91e6b26421dac7f0d72f7ffe2e57d4c30cae0c76283f67c597fff4fe3021ff37a8b01

  • SSDEEP

    768:bxNQIE0eBhkL2Fo1CCwgfjOg1tsJ6zeen7JEgx3OvRxN32RJ:bxNrC7kYo1Fxf3s06gYvRbW

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-11_f9976bb0ea78e0f7a407ba262993c8e0_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-11_f9976bb0ea78e0f7a407ba262993c8e0_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1720
    • C:\Users\Admin\AppData\Local\Temp\pissa.exe
      "C:\Users\Admin\AppData\Local\Temp\pissa.exe"
      2⤵
      • Executes dropped EXE
      PID:2036

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\pissa.exe

          Filesize

          38KB

          MD5

          9cd9923bc2b3be1def0473b49e17daa5

          SHA1

          a9453f6905baa61afc7cfc53259c463348c4d1da

          SHA256

          0eafa4979cacb67e6d7a0d2ccb342063643cef9ec6b8d1f3b7d7b6f0ff43579d

          SHA512

          46f742218c252ed36d533a00f16172c41b7b00190f8aa260bd748e38e233709ef2eb1bd6795673456cd3eefdd49373b4d9a058c87e50f81475b7cca69d938458

        • memory/1720-0-0x0000000000270000-0x0000000000276000-memory.dmp

          Filesize

          24KB

        • memory/1720-1-0x0000000000390000-0x0000000000396000-memory.dmp

          Filesize

          24KB

        • memory/1720-2-0x0000000000270000-0x0000000000276000-memory.dmp

          Filesize

          24KB

        • memory/2036-15-0x0000000000470000-0x0000000000476000-memory.dmp

          Filesize

          24KB

        • memory/2036-18-0x0000000000450000-0x0000000000456000-memory.dmp

          Filesize

          24KB