Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2024 06:43
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-03_8977a92816cbe7f7d8210c29e100bffc_cryptolocker.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
2024-04-03_8977a92816cbe7f7d8210c29e100bffc_cryptolocker.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-03_8977a92816cbe7f7d8210c29e100bffc_cryptolocker.exe
-
Size
44KB
-
MD5
8977a92816cbe7f7d8210c29e100bffc
-
SHA1
838cf97276fc5a42928fe73178920cf8ea714eeb
-
SHA256
cfc522c86dc5c88f79f8309e39526eba68c561c337f7cc9ac7cdfcd9e3133943
-
SHA512
5205a2f183ae84415035ec4430dd768731ada24acdb9c624f5eec2960186ecabe300b00405909ee804969dff8089b414de5fafc65913df3632ba55a9ffbe8e8c
-
SSDEEP
768:bxNQIE0eBhkL2Fo1CCwgfjOg1tsJ6zeen754XcwxbFqRoN6e:bxNrC7kYo1Fxf3s05rwxbFvN6e
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\pissa.exe CryptoLocker_rule2 -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2024-04-03_8977a92816cbe7f7d8210c29e100bffc_cryptolocker.exepissa.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation 2024-04-03_8977a92816cbe7f7d8210c29e100bffc_cryptolocker.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation pissa.exe -
Executes dropped EXE 1 IoCs
Processes:
pissa.exepid process 820 pissa.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
2024-04-03_8977a92816cbe7f7d8210c29e100bffc_cryptolocker.exedescription pid process target process PID 4352 wrote to memory of 820 4352 2024-04-03_8977a92816cbe7f7d8210c29e100bffc_cryptolocker.exe pissa.exe PID 4352 wrote to memory of 820 4352 2024-04-03_8977a92816cbe7f7d8210c29e100bffc_cryptolocker.exe pissa.exe PID 4352 wrote to memory of 820 4352 2024-04-03_8977a92816cbe7f7d8210c29e100bffc_cryptolocker.exe pissa.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_8977a92816cbe7f7d8210c29e100bffc_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-03_8977a92816cbe7f7d8210c29e100bffc_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\pissa.exe"C:\Users\Admin\AppData\Local\Temp\pissa.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
PID:820
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44KB
MD57ab94442c197f7be2eec50de53d97f7d
SHA1157cf071b2cbb8d1b03663475241bcb5ccd6d36d
SHA256a50d69441caa8916307ad803606190905df7ced64b95e3c41b9f621143a86e80
SHA5126dc8140cfe04779f890d3ee35885c100ea6e942acd0a40a4158351167f512bfffc0e18543b1a1f699e9b29131909601145b46def958b12e566a63ad3f6d73ba0
-
Filesize
261B
MD511bed1c06d8f4680de5154405be20365
SHA19c3095f1aa0b02924c23592d1e86673bb0081ca1
SHA256bcc0582f122db6e61d2aa06628275f5b882c01ca037699427d0f68e48d744666
SHA512050bb38ff33ab7e8e8aa647cffb26d2b0a54074340e79f0acf0db8f076c421505f1e4c1ce169d55aeacd4085ce258a78d24327c9393650642963beb130517da8