Analysis

  • max time kernel
    119s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    22/04/2024, 07:33

General

  • Target

    2024-04-22_256bf52a32cac6531230d4bb8f9e6891_cryptolocker.exe

  • Size

    33KB

  • MD5

    256bf52a32cac6531230d4bb8f9e6891

  • SHA1

    6ca6592f15724865ecda035df9e9578b364cbd49

  • SHA256

    116f73fc7e931d9a76c2c958ca5e7bc53e8ab6364cc8f8d278817fd4b3997d27

  • SHA512

    6464ec9dd105bc244ac7f50eb63b2c99053153b194658d561f2f0819da89f9f2844d36c819daf5c51a4dd3ab575856faafac00e13de2c2bdaafa9261d8c3e0fe

  • SSDEEP

    768:bxNQIE0eBhkL2Fo1CCwgfjOg9Arbkzos5Po:bxNrC7kYo1Fxf2rYs

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-22_256bf52a32cac6531230d4bb8f9e6891_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-22_256bf52a32cac6531230d4bb8f9e6891_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1400
    • C:\Users\Admin\AppData\Local\Temp\pissa.exe
      "C:\Users\Admin\AppData\Local\Temp\pissa.exe"
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      PID:2520

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\pissa.exe

    Filesize

    33KB

    MD5

    ed56ab467704ac9304771422703a4185

    SHA1

    17101e926d0ef6ad5e4bd098780b65dee2a82674

    SHA256

    5f60bf56fcae9f1ecb4bdf35f833d2b06ec160bafa7c540f96f38c2be9893e9a

    SHA512

    3574565cc4bb92c31fb3a91047f437d899db87ae8b9ae888aefbc09713f84e5e4a6c9b496d57ae0e3bcfb29ca8f852d6ce7b4502ecddde42b8119776a3c33be3

  • memory/1400-0-0x0000000000390000-0x0000000000396000-memory.dmp

    Filesize

    24KB

  • memory/1400-1-0x00000000005D0000-0x00000000005D6000-memory.dmp

    Filesize

    24KB

  • memory/1400-2-0x0000000000390000-0x0000000000396000-memory.dmp

    Filesize

    24KB

  • memory/2520-15-0x0000000001CA0000-0x0000000001CA6000-memory.dmp

    Filesize

    24KB

  • memory/2520-16-0x0000000001C80000-0x0000000001C86000-memory.dmp

    Filesize

    24KB