d9d3c46f3574c4dd7cedd15a28705bd860f56ed0206babce97d6a33c41bbd79c

Analysis

max time kernel
0s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/06/2024, 03:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-06_324bc571ad8cafb441f724eee2b01c86_cryptolocker.exe
Size

35KB
MD5

324bc571ad8cafb441f724eee2b01c86
SHA1

93c9f3e946b6ec5a33d76009de09593f5753274e
SHA256

d9d3c46f3574c4dd7cedd15a28705bd860f56ed0206babce97d6a33c41bbd79c
SHA512

8ca8a32bf8025d0cd89a285c13325598c34a860bb6f7ebd5f3c244f441d533bfef26bdc0024e9eb8c021f7487a94b221871994172623cec85829f2b67dd1ddaa
SSDEEP

768:bxNQIE0eBhkL2Fo1CCwgfjOg9Arbkzos56:bxNrC7kYo1Fxf2rYO

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c0000000144e4-21.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2756	pissa.exe

Loads dropped DLL 1 IoCs

pid	Process
3056	2024-06-06_324bc571ad8cafb441f724eee2b01c86_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2756	3056	2024-06-06_324bc571ad8cafb441f724eee2b01c86_cryptolocker.exe	28
PID 3056 wrote to memory of 2756	3056	2024-06-06_324bc571ad8cafb441f724eee2b01c86_cryptolocker.exe	28
PID 3056 wrote to memory of 2756	3056	2024-06-06_324bc571ad8cafb441f724eee2b01c86_cryptolocker.exe	28
PID 3056 wrote to memory of 2756	3056	2024-06-06_324bc571ad8cafb441f724eee2b01c86_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-06-06_324bc571ad8cafb441f724eee2b01c86_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-06_324bc571ad8cafb441f724eee2b01c86_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Users\Admin\AppData\Local\Temp\pissa.exe
  "C:\Users\Admin\AppData\Local\Temp\pissa.exe"
  2⤵
  - Executes dropped EXE
  PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\pissa.exe

Filesize
35KB

MD5
1d402a96095f4114edde2bb816215006

SHA1
1671ed30e48909d991870f7b65dcd3b584ba1151

SHA256
14976161f30b2ec1424a3fe4a021f87d3f8bb50838142af95f10ad247d8b802c

SHA512
b4a0c0aad222590da0861e21a1517d430d0cc9b8d4b2f6b8f93442dfd11c7ddb7f6cc178abcdd0e728c729a0cf41de09304a60e89ade22f116208197eddd432a

Download Submit
memory/2756-22-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2756-15-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/3056-0-0x0000000001CE0000-0x0000000001CE6000-memory.dmp

Filesize
24KB

Download
memory/3056-8-0x0000000001CE0000-0x0000000001CE6000-memory.dmp

Filesize
24KB

Download
memory/3056-1-0x0000000001CF0000-0x0000000001CF6000-memory.dmp

Filesize
24KB

Download