Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
23/10/2023, 19:44
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.2023-09-06_e9c5b1014bb7cba414f89aa675be7bd3_cryptolocker_JC.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.2023-09-06_e9c5b1014bb7cba414f89aa675be7bd3_cryptolocker_JC.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.2023-09-06_e9c5b1014bb7cba414f89aa675be7bd3_cryptolocker_JC.exe
-
Size
36KB
-
MD5
e9c5b1014bb7cba414f89aa675be7bd3
-
SHA1
8024ff408520bd7ae5c235b369b59d5a8a0abf16
-
SHA256
a526e7f011f1c8662af15383f43b5f5c48a26bb3981fcd964e03eab838949e9f
-
SHA512
7bcef00ed86f1140f0d4ef8e47b916adaf096686c714b0fb5364f47a42b5a634c7bcd246128dea2056d463a03ead5f8b59f519895408bec5cce018f79e3c1004
-
SSDEEP
768:Kf1K2exg2kBwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZsBGGpNEmNOmnQBDna:o1KhxqwtdgI2MyzNORQtOflIwoHNV2X7
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation hurok.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation NEAS.2023-09-06_e9c5b1014bb7cba414f89aa675be7bd3_cryptolocker_JC.exe -
Executes dropped EXE 1 IoCs
pid Process 4856 hurok.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 964 wrote to memory of 4856 964 NEAS.2023-09-06_e9c5b1014bb7cba414f89aa675be7bd3_cryptolocker_JC.exe 88 PID 964 wrote to memory of 4856 964 NEAS.2023-09-06_e9c5b1014bb7cba414f89aa675be7bd3_cryptolocker_JC.exe 88 PID 964 wrote to memory of 4856 964 NEAS.2023-09-06_e9c5b1014bb7cba414f89aa675be7bd3_cryptolocker_JC.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-06_e9c5b1014bb7cba414f89aa675be7bd3_cryptolocker_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-06_e9c5b1014bb7cba414f89aa675be7bd3_cryptolocker_JC.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Users\Admin\AppData\Local\Temp\hurok.exe"C:\Users\Admin\AppData\Local\Temp\hurok.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
PID:4856
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD599a26c94dfd44f36ff3ec72f2b9645f5
SHA1da0e60095b9df13c1479803cf54d3f170966703c
SHA25627ccb82ae585a5eb828698189240846fe5f89d5063b646d562bd7a96fd2949a3
SHA512c3767762dcccfaccbd8bd2ac5ef3e518b6ffdca6f3bb3ba4dd6e23328c2572a31732e7c95c2506bf580496c0cf506a872f1128bfee485ae074ac9904b700337c
-
Filesize
36KB
MD599a26c94dfd44f36ff3ec72f2b9645f5
SHA1da0e60095b9df13c1479803cf54d3f170966703c
SHA25627ccb82ae585a5eb828698189240846fe5f89d5063b646d562bd7a96fd2949a3
SHA512c3767762dcccfaccbd8bd2ac5ef3e518b6ffdca6f3bb3ba4dd6e23328c2572a31732e7c95c2506bf580496c0cf506a872f1128bfee485ae074ac9904b700337c
-
Filesize
36KB
MD599a26c94dfd44f36ff3ec72f2b9645f5
SHA1da0e60095b9df13c1479803cf54d3f170966703c
SHA25627ccb82ae585a5eb828698189240846fe5f89d5063b646d562bd7a96fd2949a3
SHA512c3767762dcccfaccbd8bd2ac5ef3e518b6ffdca6f3bb3ba4dd6e23328c2572a31732e7c95c2506bf580496c0cf506a872f1128bfee485ae074ac9904b700337c