ea0a9bcd2074948bbd843836f64f4ed6dde0c960126154f4f0675bae80f79ccd

Analysis

max time kernel
134s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 02:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-24_8a2a97d81bb7db016007e03ed525f531_cryptolocker.exe
Size

34KB
MD5

8a2a97d81bb7db016007e03ed525f531
SHA1

6e701424659254722421fb334a193ecf404b29c9
SHA256

ea0a9bcd2074948bbd843836f64f4ed6dde0c960126154f4f0675bae80f79ccd
SHA512

ee6a8028e238f112b68269fc0fced92bee568b7551eb72e158f42b78cc0aea0baa410d66580f4c0c373ea2afb803648598489bf0feeeb60d05e2b428543336b2
SSDEEP

768:bxNQIE0eBhkL2Fo1CCwgfjOg9Arbkzos5R:bxNrC7kYo1Fxf2rY9

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0006000000023286-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	2024-05-24_8a2a97d81bb7db016007e03ed525f531_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	pissa.exe

Executes dropped EXE 1 IoCs

pid	Process
1056	pissa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 1056	3200	2024-05-24_8a2a97d81bb7db016007e03ed525f531_cryptolocker.exe	85
PID 3200 wrote to memory of 1056	3200	2024-05-24_8a2a97d81bb7db016007e03ed525f531_cryptolocker.exe	85
PID 3200 wrote to memory of 1056	3200	2024-05-24_8a2a97d81bb7db016007e03ed525f531_cryptolocker.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-05-24_8a2a97d81bb7db016007e03ed525f531_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-24_8a2a97d81bb7db016007e03ed525f531_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Users\Admin\AppData\Local\Temp\pissa.exe
  "C:\Users\Admin\AppData\Local\Temp\pissa.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:1056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\pissa.exe

Filesize
35KB

MD5
d8404bd4bd4e6aa00aa84c7b387c1c6c

SHA1
ecc7104e2ecf8e970fc1c3b0da315fb841f3daaa

SHA256
319bd9dc3717c62c3cf01da1f0d91c3b23af4a73a70c6dd21889de458e696478

SHA512
4fec8788b5b29b4edc158d8dec2469483774167d7f154c714aadd239ff63e73306170a2510445d349790cce213bd6d0b77263fa9c7fa07006c9e12509d8c8029

Download Submit
C:\Users\Admin\AppData\Local\Temp\pissec.exe

Filesize
261B

MD5
11bed1c06d8f4680de5154405be20365

SHA1
9c3095f1aa0b02924c23592d1e86673bb0081ca1

SHA256
bcc0582f122db6e61d2aa06628275f5b882c01ca037699427d0f68e48d744666

SHA512
050bb38ff33ab7e8e8aa647cffb26d2b0a54074340e79f0acf0db8f076c421505f1e4c1ce169d55aeacd4085ce258a78d24327c9393650642963beb130517da8

Download Submit
memory/1056-17-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download
memory/1056-23-0x0000000002060000-0x0000000002066000-memory.dmp

Filesize
24KB

Download
memory/3200-0-0x0000000002160000-0x0000000002166000-memory.dmp

Filesize
24KB

Download
memory/3200-1-0x0000000002190000-0x0000000002196000-memory.dmp

Filesize
24KB

Download
memory/3200-8-0x0000000002160000-0x0000000002166000-memory.dmp

Filesize
24KB

Download