Analysis
-
max time kernel
139s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 02:23
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-23_171a2f8a391d6a9a909bf796ab6cd90c_cryptolocker.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2024-05-23_171a2f8a391d6a9a909bf796ab6cd90c_cryptolocker.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-23_171a2f8a391d6a9a909bf796ab6cd90c_cryptolocker.exe
-
Size
35KB
-
MD5
171a2f8a391d6a9a909bf796ab6cd90c
-
SHA1
bb4d29f712f2cc98ec3d07e38c943cb074bee0e5
-
SHA256
659bc0cb3a437af52fd1465703e07180bd15a01c89dc0dbec442f4e89af61008
-
SHA512
b5bd876d4ced30658f4230888cf93309f80808903764b78315063e1d0613cf738dc573d004446ac31ef69e20013f9f62f7cb6c07a11ea5db92a23e3afea596f6
-
SSDEEP
768:bxNQIE0eBhkL2Fo1CCwgfjOg9Arbkzos5Pp7JH:bxNrC7kYo1Fxf2rY1dH
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\pissa.exe CryptoLocker_rule2 -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2024-05-23_171a2f8a391d6a9a909bf796ab6cd90c_cryptolocker.exepissa.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 2024-05-23_171a2f8a391d6a9a909bf796ab6cd90c_cryptolocker.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation pissa.exe -
Executes dropped EXE 1 IoCs
Processes:
pissa.exepid process 3820 pissa.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
2024-05-23_171a2f8a391d6a9a909bf796ab6cd90c_cryptolocker.exedescription pid process target process PID 5000 wrote to memory of 3820 5000 2024-05-23_171a2f8a391d6a9a909bf796ab6cd90c_cryptolocker.exe pissa.exe PID 5000 wrote to memory of 3820 5000 2024-05-23_171a2f8a391d6a9a909bf796ab6cd90c_cryptolocker.exe pissa.exe PID 5000 wrote to memory of 3820 5000 2024-05-23_171a2f8a391d6a9a909bf796ab6cd90c_cryptolocker.exe pissa.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_171a2f8a391d6a9a909bf796ab6cd90c_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_171a2f8a391d6a9a909bf796ab6cd90c_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\pissa.exe"C:\Users\Admin\AppData\Local\Temp\pissa.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\pissa.exeFilesize
35KB
MD51f03407793f7a443bbfd3a240cb2fa1c
SHA1d26dcffb6b049b0f26a721b3f48adc1028743446
SHA25669d9dc46686ae93d1a31e107f6a3801cac127e90e9105fecc69d54af23f4d90d
SHA512946a9a222c1f358e8d59dfde73b0562abc0a39e061e77efb518b5c3dc1c99aad6561291fdf6b55cd38c2c427e31b3fdf449bab722d94013c2eb22e34724f1fab
-
C:\Users\Admin\AppData\Local\Temp\pissec.exeFilesize
261B
MD511bed1c06d8f4680de5154405be20365
SHA19c3095f1aa0b02924c23592d1e86673bb0081ca1
SHA256bcc0582f122db6e61d2aa06628275f5b882c01ca037699427d0f68e48d744666
SHA512050bb38ff33ab7e8e8aa647cffb26d2b0a54074340e79f0acf0db8f076c421505f1e4c1ce169d55aeacd4085ce258a78d24327c9393650642963beb130517da8
-
memory/3820-18-0x0000000002190000-0x0000000002196000-memory.dmpFilesize
24KB
-
memory/3820-23-0x0000000002160000-0x0000000002166000-memory.dmpFilesize
24KB
-
memory/5000-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmpFilesize
24KB
-
memory/5000-1-0x0000000003150000-0x0000000003156000-memory.dmpFilesize
24KB
-
memory/5000-8-0x0000000002EA0000-0x0000000002EA6000-memory.dmpFilesize
24KB