Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/01/2024, 00:30

General

  • Target

    2024-01-23_86096055f173830ee85352bc9caf4b96_cryptolocker.exe

  • Size

    72KB

  • MD5

    86096055f173830ee85352bc9caf4b96

  • SHA1

    647744389962512dd471d64c0dc49bf481af7ecb

  • SHA256

    e5c6ab36ad40c8d469c2e8a2b789742c0f628c132356bdbad37761f8131b5e25

  • SHA512

    e739d49a3881956dec7b54a77db891ebfca6d4ea01aa29f9849bd262cae4ae2c200bdea2e673dcf5724389ab4e233e898ad4c280c8a951bdbfbd2c94de50ccc2

  • SSDEEP

    1536:X6QFElP6n+gJQMOtEvwDpjBZYTjipvF2bx1Ma:X6a+SOtEvwDpjBZYvQd23

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-01-23_86096055f173830ee85352bc9caf4b96_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-23_86096055f173830ee85352bc9caf4b96_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:396
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:3828

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    72KB

    MD5

    76072aeba96d523ee4e6e4f598e5074f

    SHA1

    9d4f32adc2bfcf2d9418b85bb594b2e5b6b6058d

    SHA256

    1b2746b08deba9aa20f66d007477a65c725628a72fe830b25e535fe4abf8dda3

    SHA512

    89f8d92f0addc0ca8d33729a4d6c7988858ba54386bf8511f9fbbc958c64156482d3ddd72ec8e9979f98032cead2638c2b29d6be14eb6d66eaf1f52ce690c1ce

  • memory/396-0-0x0000000000730000-0x0000000000736000-memory.dmp

    Filesize

    24KB

  • memory/396-2-0x0000000000750000-0x0000000000756000-memory.dmp

    Filesize

    24KB

  • memory/396-1-0x0000000000730000-0x0000000000736000-memory.dmp

    Filesize

    24KB

  • memory/3828-17-0x00000000004F0000-0x00000000004F6000-memory.dmp

    Filesize

    24KB

  • memory/3828-19-0x00000000004D0000-0x00000000004D6000-memory.dmp

    Filesize

    24KB