473b91124fce97810a4d0142f69aef52c147752925071e02f2622e8d3d306ec8

Analysis

max time kernel
153s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2024 03:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-27_5fdc0d307303481d8ecdcaa8d02f1819_cryptolocker.exe
Size

37KB
MD5

5fdc0d307303481d8ecdcaa8d02f1819
SHA1

c8bff4729a6c3bf961bae4ea3778c41aaf2d2d4f
SHA256

473b91124fce97810a4d0142f69aef52c147752925071e02f2622e8d3d306ec8
SHA512

dea5a75e4fa2d43d46c3c132a6cd117aa292e3fdd9b8c1f65b542778d48b7be6248b54d2347712a185110d502a03600e9ef74f51c1bc39276aeb262bfb2fd1ec
SSDEEP

768:bxNQIE0eBhkL2Fo1CCwgfjOg1tsJ6zeen7JE59:bxNrC7kYo1Fxf3s0659

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000700000002324f-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	2024-03-27_5fdc0d307303481d8ecdcaa8d02f1819_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1612	pissa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 1612	2076	2024-03-27_5fdc0d307303481d8ecdcaa8d02f1819_cryptolocker.exe	99
PID 2076 wrote to memory of 1612	2076	2024-03-27_5fdc0d307303481d8ecdcaa8d02f1819_cryptolocker.exe	99
PID 2076 wrote to memory of 1612	2076	2024-03-27_5fdc0d307303481d8ecdcaa8d02f1819_cryptolocker.exe	99

C:\Users\Admin\AppData\Local\Temp\2024-03-27_5fdc0d307303481d8ecdcaa8d02f1819_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-27_5fdc0d307303481d8ecdcaa8d02f1819_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Users\Admin\AppData\Local\Temp\pissa.exe
  "C:\Users\Admin\AppData\Local\Temp\pissa.exe"
  2⤵
  - Executes dropped EXE
  PID:1612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3896 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:3836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\pissa.exe

Filesize
37KB

MD5
66aad84300cc3ae8ecea9d68375983f0

SHA1
33a3347eb4dc4de4d7cc8749285a7b58faaa0b12

SHA256
04c85b228b1698bb052b02293a87c00aff4f5c300321e6a79ad7db6c594675ab

SHA512
dade45ce7efea1e38a3e426838d1d6fa14d5003cbb556298b7dfe2562d29497dc778dcbecef80e54fc31108a91ee48c89b66e26be4f09a04dc28baf727f7c088

Download Submit
memory/1612-17-0x0000000003010000-0x0000000003016000-memory.dmp

Filesize
24KB

Download
memory/1612-20-0x0000000002150000-0x0000000002156000-memory.dmp

Filesize
24KB

Download
memory/2076-0-0x00000000021E0000-0x00000000021E6000-memory.dmp

Filesize
24KB

Download
memory/2076-1-0x00000000021E0000-0x00000000021E6000-memory.dmp

Filesize
24KB

Download
memory/2076-2-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download