Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/10/2023, 16:18

General

  • Target

    2023-08-27_245600f18b0df70f50a259202cb26a55_cryptolocker_JC.exe

  • Size

    69KB

  • MD5

    245600f18b0df70f50a259202cb26a55

  • SHA1

    989ab47075cdab023027ad6ab505985cbb2fd411

  • SHA256

    87ee2a62b1b4fc834f8e8e6836662e7b32ccb6ad5d0d99d5be3769be66cc73e4

  • SHA512

    67ce1032499fdea3ed41d388b1ff51f9379694ef5d26698a36a56964b8bb44e86b65c3e1dc619f666e30fb86f28ae75e996c290e3ce0cf02209c12f6a3d3c4b6

  • SSDEEP

    1536:X6QFElP6n+gJQMOtEvwDpjBZYTjipvF2bx1b8:X6a+SOtEvwDpjBZYvQd2w

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2023-08-27_245600f18b0df70f50a259202cb26a55_cryptolocker_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\2023-08-27_245600f18b0df70f50a259202cb26a55_cryptolocker_JC.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1872
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:1032

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    69KB

    MD5

    40561dbc4b9a03fb26a180184ac55c9c

    SHA1

    6856a313f3f12161b9dd9a9d388bc21e679b5999

    SHA256

    76797444d213341c61d710bf33de4f40134aab9ce97240e80d736da382ed5034

    SHA512

    3701a49b5144c0b10dc5036e6c50d9540a6e93918d079e819e1934e56144afed906ca24752e6a596d8cb898d5a19536d6f031342e07f9991afaeebd705431992

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    69KB

    MD5

    40561dbc4b9a03fb26a180184ac55c9c

    SHA1

    6856a313f3f12161b9dd9a9d388bc21e679b5999

    SHA256

    76797444d213341c61d710bf33de4f40134aab9ce97240e80d736da382ed5034

    SHA512

    3701a49b5144c0b10dc5036e6c50d9540a6e93918d079e819e1934e56144afed906ca24752e6a596d8cb898d5a19536d6f031342e07f9991afaeebd705431992

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    69KB

    MD5

    40561dbc4b9a03fb26a180184ac55c9c

    SHA1

    6856a313f3f12161b9dd9a9d388bc21e679b5999

    SHA256

    76797444d213341c61d710bf33de4f40134aab9ce97240e80d736da382ed5034

    SHA512

    3701a49b5144c0b10dc5036e6c50d9540a6e93918d079e819e1934e56144afed906ca24752e6a596d8cb898d5a19536d6f031342e07f9991afaeebd705431992

  • memory/1032-18-0x00000000005C0000-0x00000000005C6000-memory.dmp

    Filesize

    24KB

  • memory/1032-17-0x00000000005A0000-0x00000000005A6000-memory.dmp

    Filesize

    24KB

  • memory/1872-0-0x00000000004D0000-0x00000000004D6000-memory.dmp

    Filesize

    24KB

  • memory/1872-1-0x00000000004D0000-0x00000000004D6000-memory.dmp

    Filesize

    24KB

  • memory/1872-2-0x00000000004F0000-0x00000000004F6000-memory.dmp

    Filesize

    24KB