Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/01/2024, 03:29

General

  • Target

    2024-01-28_591a3c464577563901a82e9e36d4c975_cryptolocker.exe

  • Size

    81KB

  • MD5

    591a3c464577563901a82e9e36d4c975

  • SHA1

    4aab4428d7c5bb58d80583f548e4cfb900421d25

  • SHA256

    cdabc84f446ffa31595537c61a9ea2848d864f44a00cc410f6d9920bcdc91d5b

  • SHA512

    427e70564cebd1cd71c14e3c4fcb4abf9faa3ae6a5dc5114565e1e1823604e879ef8f740bba23d006a7e866fc0df4d86330675707a7342ddb0add16d4f0a722b

  • SSDEEP

    768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpj/MLa5VccPtNw5CS95yFPFh6:V6QFElP6n+gMQMOtEvwDpjyaLccVNlV6

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-01-28_591a3c464577563901a82e9e36d4c975_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-28_591a3c464577563901a82e9e36d4c975_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:800
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:5088

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    81KB

    MD5

    3a263c2653af78579c53a9ad887a7130

    SHA1

    5fe837af89135d9a7ca469d67a32647f56f362cf

    SHA256

    3c77de2aa2ca7ef2575c5ac476ae70c2a88b34728ffef9d3b4ba67a5d705d06c

    SHA512

    40cfce383fa6ddd28f077b1c155f3e7f0a8da69df75f7a88dee6825e248a0336c7cd3eb0f2e8e3cc4aec6a4cb83db2ff7e8c010fdb2d95ff42ef644e1dcba4be

  • memory/800-0-0x00000000004D0000-0x00000000004D6000-memory.dmp

    Filesize

    24KB

  • memory/800-1-0x00000000004D0000-0x00000000004D6000-memory.dmp

    Filesize

    24KB

  • memory/800-2-0x00000000004F0000-0x00000000004F6000-memory.dmp

    Filesize

    24KB

  • memory/5088-17-0x00000000007E0000-0x00000000007E6000-memory.dmp

    Filesize

    24KB

  • memory/5088-20-0x00000000007B0000-0x00000000007B6000-memory.dmp

    Filesize

    24KB