Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/02/2024, 20:33

General

  • Target

    2024-02-12_df55cf0e5aa893e08b81a61df5ac114c_cryptolocker.exe

  • Size

    54KB

  • MD5

    df55cf0e5aa893e08b81a61df5ac114c

  • SHA1

    b97112ea098a6a904793f6451f891ed5c40dd755

  • SHA256

    54a144181f0bd513364b8999db018836ad3051cfcd1d22a1a625c0baa6fdbb4e

  • SHA512

    42fee0936b3df09035b97605328bf044a537f983f1066bc18a72b3819018462e145c678a94cd0b034e1ebf253134aa50804f82fa3180189feb7cb3b7940a3bd4

  • SSDEEP

    768:X6LsoEEeegiZPvEhHSG+gp/BtOOtEvwDpjBVaD3E09vaTiSfQaV2L0zNnm:X6QFElP6n+gJBMOtEvwDpjBtE1yILum

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-12_df55cf0e5aa893e08b81a61df5ac114c_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-12_df55cf0e5aa893e08b81a61df5ac114c_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3048
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:3516

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    54KB

    MD5

    9ae4ecab7cce36360baefcf119bbfcf5

    SHA1

    a6ba43302a965cc3cdb8c5a0d7ef9c83f4dcc6ed

    SHA256

    d950f5942460fda1187401ba1941d95d00b54a928beb836a0e43dc26fe0a286c

    SHA512

    69d811b4190c7cd97d3e4b5678cfbf772853bb07cfbd55cb83d72d48d545f6cf0daab35e5e5359a54ca7a6b20ec3d26d8c1c94dcbdeb2fdae06f320ae4d3ed77

  • memory/3048-0-0x0000000000670000-0x0000000000676000-memory.dmp

    Filesize

    24KB

  • memory/3048-1-0x0000000000670000-0x0000000000676000-memory.dmp

    Filesize

    24KB

  • memory/3048-2-0x0000000002230000-0x0000000002236000-memory.dmp

    Filesize

    24KB

  • memory/3516-17-0x00000000006D0000-0x00000000006D6000-memory.dmp

    Filesize

    24KB

  • memory/3516-19-0x00000000006A0000-0x00000000006A6000-memory.dmp

    Filesize

    24KB