Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    0s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/01/2024, 05:48

General

  • Target

    2024-01-01_a8cc6ae17a80640733844d7e99f3905a_cryptolocker.exe

  • Size

    65KB

  • MD5

    a8cc6ae17a80640733844d7e99f3905a

  • SHA1

    14c1c8758873538fd56cd23afdfa09c3f948aa4a

  • SHA256

    5064fc8a5cf7b83b6e0a8cea12a43611d43e718d45449fdadf491a89e57fe6b5

  • SHA512

    ba6a5a6943bc99124040b842d835ffe6dd897dd75cff5bc9caebd7a6bee06695c2885f87c1012aff267a3381387ad88bc7f43d1c9928744a88c1d45ae2495c4b

  • SSDEEP

    1536:Dk/xY0sllyGQMOtEvwDpjwycDtKkQZQRKb61vSbgZ3QzNKwU1:DW60sllyWOtEvwDpjwF85s

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-01-01_a8cc6ae17a80640733844d7e99f3905a_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-01_a8cc6ae17a80640733844d7e99f3905a_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    PID:1052
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
        PID:1528

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\asih.exe

      Filesize

      41KB

      MD5

      6417523d0ec034f0b7f0099ec5315c68

      SHA1

      b3d6961860d6950bf3ec4b41d77f26fd3c8a9567

      SHA256

      8ffa9c817aa6678f48e78b92719440b39b1300047cbe38b6d14f8af6a9e179cb

      SHA512

      5923a65b334a6ddc815b12c6e464e695a0c5ea4617881943eabf9cec1ecb844ea7e448787102d7dd1133dbf168b89b4f05cf092a1f46ea25caf19292d64d81eb

    • C:\Users\Admin\AppData\Local\Temp\asih.exe

      Filesize

      8KB

      MD5

      c40a5bf18223df914375ea6fd5633e91

      SHA1

      7ba678ef18e95b5c0fb4ed9c4ff3997e07b1ab13

      SHA256

      753368b6716265096c0d4412fb1bac9bf6af8afa37f9cdaa9218ede92ae1fe24

      SHA512

      187352d5e8a677d99cf13a47cfa8a26d30039ace640a0603d82dc273887d5554cd3bb044e934f18af24ee7d6a4e06674519c05a16e008123a2b84a91431ba8b8

    • C:\Users\Admin\AppData\Local\Temp\asih.exe

      Filesize

      66KB

      MD5

      700f0073b1f7ddf8051548826fefb130

      SHA1

      ba0dbc0d0ab8687860ee91d1690548099edb1d84

      SHA256

      1f89a495bf2c8e2e74df3c6f5ebe0384060c61ee501812c5abc671189f1ec108

      SHA512

      6b7c6312bc89c7aca0b0b20a8fa05ee3aee8309ad4e11ae9092342b94921f823fef2d7dc80bc721e8c094480fa971b25309bce0036b6dadbb47be227a7bac545

    • memory/1052-0-0x0000000000500000-0x000000000050B000-memory.dmp

      Filesize

      44KB

    • memory/1052-3-0x00000000006C0000-0x00000000006C6000-memory.dmp

      Filesize

      24KB

    • memory/1052-2-0x00000000006A0000-0x00000000006A6000-memory.dmp

      Filesize

      24KB

    • memory/1052-18-0x0000000000500000-0x000000000050B000-memory.dmp

      Filesize

      44KB

    • memory/1052-1-0x00000000006A0000-0x00000000006A6000-memory.dmp

      Filesize

      24KB

    • memory/1528-20-0x00000000005E0000-0x00000000005E6000-memory.dmp

      Filesize

      24KB

    • memory/1528-26-0x00000000004E0000-0x00000000004E6000-memory.dmp

      Filesize

      24KB

    • memory/1528-17-0x0000000000500000-0x000000000050B000-memory.dmp

      Filesize

      44KB