Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/06/2024, 09:44

General

  • Target

    20240615ca2ec9980965947837cf8b9591503480cryptolocker.exe

  • Size

    35KB

  • MD5

    ca2ec9980965947837cf8b9591503480

  • SHA1

    70090e434cd43074629c5dabcf3e817289b0b6d2

  • SHA256

    8415eff993a8e0f14bd9390936e31b03333ab0ced4b34c2c4d4d8c3c8eaa4813

  • SHA512

    942b93d7d05c85efc68dff30f4ed6b63a9ee37c2816c0d92ff7840c6c6c349aa24c3a6ac9de705486d5586739757bda5d9a487414f80c4d226438475ddb7b52a

  • SSDEEP

    768:bxNQIE0eBhkL2Fo1CCwgfjOg9Arbkzos5jmUY:bxNrC7kYo1Fxf2rYPLY

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\20240615ca2ec9980965947837cf8b9591503480cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\20240615ca2ec9980965947837cf8b9591503480cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1240
    • C:\Users\Admin\AppData\Local\Temp\pissa.exe
      "C:\Users\Admin\AppData\Local\Temp\pissa.exe"
      2⤵
      • Executes dropped EXE
      PID:3692

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\pissa.exe

    Filesize

    35KB

    MD5

    3cd009ddd0571cae85750df29920353c

    SHA1

    9f5a448ac6974d089a1428f2c15664ed2ece91ac

    SHA256

    79edde4097a42409109f7ca5fed2a2fa88db585a27447c45db5d998d3aabfc85

    SHA512

    b421b721bdeeb4ff8d063dbf5681cff50db7ab47124a3ba54066f3ba15a5c1338fa7bc2e38ad341c361469c6d26578a08b0aa13a9dc38eb60508ebb177be5b10

  • memory/1240-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

    Filesize

    24KB

  • memory/1240-1-0x0000000003150000-0x0000000003156000-memory.dmp

    Filesize

    24KB

  • memory/1240-8-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

    Filesize

    24KB

  • memory/3692-23-0x0000000002160000-0x0000000002166000-memory.dmp

    Filesize

    24KB