c77a6694a2b642463993e884cc14843b5d4017a0c4749e385fd5db44f5b65126

Analysis

max time kernel
91s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 23:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-26_9a1f69b7e03817ab42d05f96090d0e39_cryptolocker.exe
Size

45KB
MD5

9a1f69b7e03817ab42d05f96090d0e39
SHA1

72236c4afdfa1b25aac6fcd1cd8d0bcdae4bb7a2
SHA256

c77a6694a2b642463993e884cc14843b5d4017a0c4749e385fd5db44f5b65126
SHA512

5b638b674816a4d40f4ece8029ae416bc0fa2b087a77a471778d31d10c981c2871bf370abc5f1ea5a099925e4742ed1e85bb9d4170d9f78d0c98dcc33bd558f4
SSDEEP

768:bxNQIE0eBhkL2Fo1CCwgfjOg1tsJ6zeen754XcwxbFp13/7xlbC:bxNrC7kYo1Fxf3s05rwxbF73NlW

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023416-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	2024-05-26_9a1f69b7e03817ab42d05f96090d0e39_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	pissa.exe

Executes dropped EXE 1 IoCs

pid	Process
4992	pissa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 4992	3308	2024-05-26_9a1f69b7e03817ab42d05f96090d0e39_cryptolocker.exe	81
PID 3308 wrote to memory of 4992	3308	2024-05-26_9a1f69b7e03817ab42d05f96090d0e39_cryptolocker.exe	81
PID 3308 wrote to memory of 4992	3308	2024-05-26_9a1f69b7e03817ab42d05f96090d0e39_cryptolocker.exe	81

C:\Users\Admin\AppData\Local\Temp\2024-05-26_9a1f69b7e03817ab42d05f96090d0e39_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-26_9a1f69b7e03817ab42d05f96090d0e39_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Users\Admin\AppData\Local\Temp\pissa.exe
  "C:\Users\Admin\AppData\Local\Temp\pissa.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\pissa.exe

Filesize
45KB

MD5
251edfeef7ce264236cfd260cb6dd391

SHA1
fc28331d26998efea931f3dd5850f24c4b030505

SHA256
be17fb9ab482178c57ec2095475fc01397fd5c6e38c5edbe6ae87e7f5dbe79b8

SHA512
4a999beaddf5b5734b840e212035270920a1352eb00cd227cb4e8e219756da3c701ac42a514f1fffcfd17d8fc9e360c1edad6e504af2d82ef254039bd1ad457b

Download Submit
C:\Users\Admin\AppData\Local\Temp\pissec.exe

Filesize
261B

MD5
11bed1c06d8f4680de5154405be20365

SHA1
9c3095f1aa0b02924c23592d1e86673bb0081ca1

SHA256
bcc0582f122db6e61d2aa06628275f5b882c01ca037699427d0f68e48d744666

SHA512
050bb38ff33ab7e8e8aa647cffb26d2b0a54074340e79f0acf0db8f076c421505f1e4c1ce169d55aeacd4085ce258a78d24327c9393650642963beb130517da8

Download Submit
memory/3308-0-0x00000000020D0000-0x00000000020D6000-memory.dmp

Filesize
24KB

Download
memory/3308-2-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download
memory/3308-7-0x00000000020D0000-0x00000000020D6000-memory.dmp

Filesize
24KB

Download
memory/4992-23-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download