Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    138s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/01/2024, 08:43

General

  • Target

    2024-01-24_f8e3c2de4fcd735db89322eccc30cb2a_cryptolocker.exe

  • Size

    47KB

  • MD5

    f8e3c2de4fcd735db89322eccc30cb2a

  • SHA1

    5f6df22404ca1b48dc04a5b8f10651a28b06088e

  • SHA256

    24a4173724331b1fbdf97a83a2ae5179742ebeb9b41d88c3175882b94bc6ac85

  • SHA512

    dd2c57636d3ffe75d5d58f4ed52a2d57c309f6589009ca6d4905d8a24da1edc0779f0d3ff4dbbed46624ff0f047f0d86ce3adfa36c17a2320ba4044707eaa609

  • SSDEEP

    768:Kf1K2exg2kBwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZsBGGpebVIYLHA3KxG:o1KhxqwtdgI2MyzNORQtOflIwoHNV2Xz

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-01-24_f8e3c2de4fcd735db89322eccc30cb2a_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-24_f8e3c2de4fcd735db89322eccc30cb2a_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3368
    • C:\Users\Admin\AppData\Local\Temp\hurok.exe
      "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      PID:1652

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\hurok.exe

    Filesize

    47KB

    MD5

    0c7ef1409974191141b0b93743317dc3

    SHA1

    0312998ed2ccff48b7bd9014d1d11fc98ef0c534

    SHA256

    55ce68910662a0ca4c7cd6a59efcebb7e5d30d01fb6e8b142034e644abccbd31

    SHA512

    fcca1748ce3dffbaa7571c8250a97f0be57caa91166de64573094ef2fbf42b99d205d694ca95ed3ff11ac60f9b2a181c3ca8c3904b08ff70f49fdd36757077c5

  • memory/1652-20-0x00000000004D0000-0x00000000004D6000-memory.dmp

    Filesize

    24KB

  • memory/3368-0-0x00000000022F0000-0x00000000022F6000-memory.dmp

    Filesize

    24KB

  • memory/3368-1-0x00000000022F0000-0x00000000022F6000-memory.dmp

    Filesize

    24KB

  • memory/3368-2-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB