Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    133s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/02/2024, 19:23

General

  • Target

    2024-02-12_4f27026f7924caf742d6a7b7f970c872_cryptolocker.exe

  • Size

    59KB

  • MD5

    4f27026f7924caf742d6a7b7f970c872

  • SHA1

    d440803a63ebba428f27d9636dcac6433cedbe40

  • SHA256

    2f21df43f92490fd774b82ed58369a4f942db7bd5be2a75111025d50153c426f

  • SHA512

    e116fa2aaddee0c61435d975e2af2df46084fd98eb9e7c1f93abb6ad4bd641902e6ea191fdc271112dd230462c4585d4b625360b0ee19b2131ef7c4ddcc188df

  • SSDEEP

    1536:ZzFbxmLPWQMOtEvwDpj38lD/cMAT+lBhn:ZVxkGOtEvwDpjI

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-12_4f27026f7924caf742d6a7b7f970c872_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-12_4f27026f7924caf742d6a7b7f970c872_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2216
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      PID:4988

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    59KB

    MD5

    7ee602dfad9cfc37a9f874a1ebaf6b65

    SHA1

    48665d915ccf00facad37e836a9baf036daef549

    SHA256

    bb980cdb8a63a25652959b338b5d288de3e8ce133cae76759ccac718a3e1ab49

    SHA512

    4f3acd45d1e13210aac4860b0569c75d02c58572f793e6dc1cdb1b02901596edc33edf8ac33f1d77c7b4424aaf2b06fbb428fb21e10798dbd420e3f1e06dbacd

  • memory/2216-0-0x0000000002190000-0x0000000002196000-memory.dmp

    Filesize

    24KB

  • memory/2216-1-0x0000000002190000-0x0000000002196000-memory.dmp

    Filesize

    24KB

  • memory/2216-2-0x00000000021B0000-0x00000000021B6000-memory.dmp

    Filesize

    24KB

  • memory/4988-16-0x0000000002190000-0x0000000002196000-memory.dmp

    Filesize

    24KB

  • memory/4988-18-0x00000000006D0000-0x00000000006D6000-memory.dmp

    Filesize

    24KB

  • memory/4988-21-0x00000000006B0000-0x00000000006B6000-memory.dmp

    Filesize

    24KB