c48d520bfc6a3ea448f47ca0c96fd3265afeab680520349d06882009153a881c

Analysis

max time kernel
146s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 15:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-11_413751da4758d8478c74e0b68abc176c_cryptolocker.exe
Size

44KB
MD5

413751da4758d8478c74e0b68abc176c
SHA1

35ab95af491aab8413322f1ca84babd5facc7650
SHA256

c48d520bfc6a3ea448f47ca0c96fd3265afeab680520349d06882009153a881c
SHA512

2292ed82ea54690764829516694a543e3bc7708f1670b51b9bcbf51c608df21d5d2290bc891cb63d04bede4bd6527ed3748aa9b1522984f1018c703aba191151
SSDEEP

768:bxNQIE0eBhkL2Fo1CCwgfjOg1tsJ6zeen754XcwxbFqRoN60:bxNrC7kYo1Fxf3s05rwxbFvN60

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000800000002326d-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	2024-03-11_413751da4758d8478c74e0b68abc176c_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2512	pissa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 2512	4980	2024-03-11_413751da4758d8478c74e0b68abc176c_cryptolocker.exe	97
PID 4980 wrote to memory of 2512	4980	2024-03-11_413751da4758d8478c74e0b68abc176c_cryptolocker.exe	97
PID 4980 wrote to memory of 2512	4980	2024-03-11_413751da4758d8478c74e0b68abc176c_cryptolocker.exe	97

C:\Users\Admin\AppData\Local\Temp\2024-03-11_413751da4758d8478c74e0b68abc176c_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-11_413751da4758d8478c74e0b68abc176c_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Users\Admin\AppData\Local\Temp\pissa.exe
  "C:\Users\Admin\AppData\Local\Temp\pissa.exe"
  2⤵
  - Executes dropped EXE
  PID:2512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4312 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\pissa.exe

Filesize
44KB

MD5
b376b0d029185b4b0554697d62513f51

SHA1
cce323011da0d61a0e86cea141b69a1b01df4c8d

SHA256
82a9427e2b88f711e759bcca047af5e22d9e4ad52b82aecceeb0061e6e40710b

SHA512
b7eea94c2f13dba4cd3bb61ff999d67cd61ccd4e6ed55fcb97305415d909e1e25ed9de0ecd671b81bbc42b5da5a165a9ce50ea8902fb0c17269d02f8c6652a09

Download Submit
memory/2512-17-0x0000000002ED0000-0x0000000002ED6000-memory.dmp

Filesize
24KB

Download
memory/2512-18-0x0000000002190000-0x0000000002196000-memory.dmp

Filesize
24KB

Download
memory/4980-0-0x0000000002340000-0x0000000002346000-memory.dmp

Filesize
24KB

Download
memory/4980-1-0x0000000002340000-0x0000000002346000-memory.dmp

Filesize
24KB

Download
memory/4980-2-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download