Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/02/2024, 09:46

General

  • Target

    2024-02-12_5f140bb6017298ca701d5b1a71630794_cryptolocker.exe

  • Size

    33KB

  • MD5

    5f140bb6017298ca701d5b1a71630794

  • SHA1

    b7500576ef9f428c8094a85450d76077f0a74be5

  • SHA256

    2876473981136e0a9e3f20c051772b9481af71a87d97bdc5fab0750174a491d3

  • SHA512

    a257293a72075ecd75214d0801db49d2b86b1c2bd8e8ffbe5f075a0d04e666f7f2fac848c99405dbf255fccc312382bea04c174149baaa7bc1223d2e416384bb

  • SSDEEP

    384:bgX4uGLLQRcsdeQ7/nQu63Ag7YmecFanrlwfjDUkKDfWf0w3sp8awF:bgX4zYcgTEu6QOaryfjqDDw3sCawF

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-12_5f140bb6017298ca701d5b1a71630794_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-12_5f140bb6017298ca701d5b1a71630794_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:976
    • C:\Users\Admin\AppData\Local\Temp\hasfj.exe
      "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
      2⤵
      • Executes dropped EXE
      PID:4904

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\hasfj.exe

    Filesize

    33KB

    MD5

    d74a44aa7d4840aeeff02928494042a4

    SHA1

    b368a225c52a552c57ef8b79080f6e70a3cd5e29

    SHA256

    49e2f55f44349afd2311d8fe20233a89467c90dc30b68e4aff007253ffb1ce75

    SHA512

    5c2353763704ed33965a50194774da3971457e9b510d62073f70eeb4867e443a8151c832ec537949173d68c46a6587ef3f67c1b7b2647ad8e5727ba00902b85e

  • memory/976-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

    Filesize

    24KB

  • memory/976-1-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

    Filesize

    24KB

  • memory/976-2-0x0000000003150000-0x0000000003156000-memory.dmp

    Filesize

    24KB

  • memory/4904-19-0x0000000002160000-0x0000000002166000-memory.dmp

    Filesize

    24KB