Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/01/2024, 11:28

General

  • Target

    2024-01-24_1f9adce5e5a2d36665d4cc7f3bbd3225_cryptolocker.exe

  • Size

    60KB

  • MD5

    1f9adce5e5a2d36665d4cc7f3bbd3225

  • SHA1

    972e961b57bd4f61e142577dfd2a8a227d0cf301

  • SHA256

    b7321d695b6f831afcfc30983c73afc8c2dcd365940623a2047cfb3b9dd3ecc7

  • SHA512

    58f98cc22b355fb33066fee70bd1e664b82b1ed2b480b8bacbdfdb57f8e8f29ef7697bac0c70052646821290d4c803bf7f5f35a12628fa0b78dd2ceee750e815

  • SSDEEP

    1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMTIC:TCjsIOtEvwDpj5HE/OUHnSMI

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 4 IoCs
  • Detection of Cryptolocker Samples 4 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-01-24_1f9adce5e5a2d36665d4cc7f3bbd3225_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-24_1f9adce5e5a2d36665d4cc7f3bbd3225_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3576
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies system certificate store
      PID:4156

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    60KB

    MD5

    02742b2189c3c18fc3c347b0a4e57f9b

    SHA1

    6af114cd21e4e5cd1abb183f74bcdb1f5f097bc1

    SHA256

    fe1be3000d29802f24f21466f6f8eb66df272e920cc2a8ef3226f13758773157

    SHA512

    7c9040b531b3c8e8dcce8d8de1e7e14603baf5fc5b5663910d2421a6370796a257effaf1e92e6da87eb4a71d65468a789ff7de7d87dd16ed312a8229278e075e

  • C:\Users\Admin\AppData\Local\Temp\misids.exe

    Filesize

    315B

    MD5

    a34ac19f4afae63adc5d2f7bc970c07f

    SHA1

    a82190fc530c265aa40a045c21770d967f4767b8

    SHA256

    d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

    SHA512

    42e53d96e5961e95b7a984d9c9778a1d3bd8ee0c87b8b3b515fa31f67c2d073c8565afc2f4b962c43668c4efa1e478da9bb0ecffa79479c7e880731bc4c55765

  • memory/3576-0-0x0000000000500000-0x000000000050E000-memory.dmp

    Filesize

    56KB

  • memory/3576-1-0x00000000005A0000-0x00000000005A6000-memory.dmp

    Filesize

    24KB

  • memory/3576-3-0x0000000002100000-0x0000000002106000-memory.dmp

    Filesize

    24KB

  • memory/3576-2-0x00000000005A0000-0x00000000005A6000-memory.dmp

    Filesize

    24KB

  • memory/3576-17-0x0000000000500000-0x000000000050E000-memory.dmp

    Filesize

    56KB

  • memory/4156-19-0x00000000007D0000-0x00000000007D6000-memory.dmp

    Filesize

    24KB

  • memory/4156-21-0x00000000006A0000-0x00000000006A6000-memory.dmp

    Filesize

    24KB

  • memory/4156-48-0x0000000000500000-0x000000000050E000-memory.dmp

    Filesize

    56KB