Analysis
-
max time kernel
134s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 02:26
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-22_24a1dffe6c2a4df238e41fb4e6cdb5ed_cryptolocker.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-05-22_24a1dffe6c2a4df238e41fb4e6cdb5ed_cryptolocker.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-22_24a1dffe6c2a4df238e41fb4e6cdb5ed_cryptolocker.exe
-
Size
34KB
-
MD5
24a1dffe6c2a4df238e41fb4e6cdb5ed
-
SHA1
a7cbbc02d631423f2347a9247ba8b28c96fac8cb
-
SHA256
d88e7ba95fe4380c3a4222c9e6b96027a386586c7ca6e4269c12167284ddbd9e
-
SHA512
5a114687d9acdd5d67778cef6a7074e81c1b607fec3820a9683f96e1b50b57104fb8898bcff1d647f3c35554bac18723552a2424488d758a84e830723cc4778a
-
SSDEEP
768:bxNQIE0eBhkL2Fo1CCwgfjOg9Arbkzos5M4gX:bxNrC7kYo1Fxf2rYA3X
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\pissa.exe CryptoLocker_rule2 -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2024-05-22_24a1dffe6c2a4df238e41fb4e6cdb5ed_cryptolocker.exepissa.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation 2024-05-22_24a1dffe6c2a4df238e41fb4e6cdb5ed_cryptolocker.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation pissa.exe -
Executes dropped EXE 1 IoCs
Processes:
pissa.exepid process 4360 pissa.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
2024-05-22_24a1dffe6c2a4df238e41fb4e6cdb5ed_cryptolocker.exedescription pid process target process PID 3804 wrote to memory of 4360 3804 2024-05-22_24a1dffe6c2a4df238e41fb4e6cdb5ed_cryptolocker.exe pissa.exe PID 3804 wrote to memory of 4360 3804 2024-05-22_24a1dffe6c2a4df238e41fb4e6cdb5ed_cryptolocker.exe pissa.exe PID 3804 wrote to memory of 4360 3804 2024-05-22_24a1dffe6c2a4df238e41fb4e6cdb5ed_cryptolocker.exe pissa.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_24a1dffe6c2a4df238e41fb4e6cdb5ed_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_24a1dffe6c2a4df238e41fb4e6cdb5ed_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\pissa.exe"C:\Users\Admin\AppData\Local\Temp\pissa.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\pissa.exeFilesize
35KB
MD5650e7255dfd71ccc16c6e8001833a00b
SHA113893417803fd74cc0a387ff7f024183e44e1aee
SHA256bee6be98b07bdacb217d8f590a841891e738cda206346931d2b80443bcc2d0b4
SHA5129a461b42bd9e16a3dcee8c801457de1d6aead2993347d0141289b5ec2825cb02a3aa7c2d6bce7ebd86c424698347639f5748e3300fb387fa6e11b3aadbbb8533
-
C:\Users\Admin\AppData\Local\Temp\pissec.exeFilesize
261B
MD511bed1c06d8f4680de5154405be20365
SHA19c3095f1aa0b02924c23592d1e86673bb0081ca1
SHA256bcc0582f122db6e61d2aa06628275f5b882c01ca037699427d0f68e48d744666
SHA512050bb38ff33ab7e8e8aa647cffb26d2b0a54074340e79f0acf0db8f076c421505f1e4c1ce169d55aeacd4085ce258a78d24327c9393650642963beb130517da8
-
memory/3804-0-0x0000000002250000-0x0000000002256000-memory.dmpFilesize
24KB
-
memory/3804-7-0x0000000002250000-0x0000000002256000-memory.dmpFilesize
24KB
-
memory/3804-1-0x0000000003150000-0x0000000003156000-memory.dmpFilesize
24KB
-
memory/4360-17-0x0000000003010000-0x0000000003016000-memory.dmpFilesize
24KB
-
memory/4360-23-0x0000000002210000-0x0000000002216000-memory.dmpFilesize
24KB