Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    89s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/02/2024, 16:29

General

  • Target

    2024-02-14_187e256f11e58ec5effa4fca53e7a93a_cryptolocker.exe

  • Size

    126KB

  • MD5

    187e256f11e58ec5effa4fca53e7a93a

  • SHA1

    71a2bc421254c4e23446b99b259bdf9724159a1a

  • SHA256

    df1c081ef7f2f3dbbb1a8cc41d0e1e95690e2604d091825d4416f2d845280393

  • SHA512

    5e0fb571e944d2b4c156199d3c2c1508cd1d548d3803210ae5c100e16d6ee1a70ee2149b40cd09fe360b7d0b245c6c193a748f127a8f0b198b5790c971abb022

  • SSDEEP

    1536:gUj+AIMOtEvwDpjNbwQEIPlemUhYwkkxGBpa5:vCA9OtEvwDpjE

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-14_187e256f11e58ec5effa4fca53e7a93a_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-14_187e256f11e58ec5effa4fca53e7a93a_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1340
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies system certificate store
      PID:3960

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    126KB

    MD5

    d41f4c163b4b78a6089fd3e43f524745

    SHA1

    a4e281a72f576d2f5a6983a9ec6138c5b7f120d9

    SHA256

    02ca93fcfb397ede71916986afb9371b20685e48532ab7155012185872bb9f80

    SHA512

    7a56f17ea1e762b27ea87345895ac979fa84c9b6f038906fd99bfc39cfc400a38741313ad0062a023cb818aa6def31d1c333548a86783514a00f38474c001345

  • C:\Users\Admin\AppData\Local\Temp\misids.exe

    Filesize

    315B

    MD5

    a34ac19f4afae63adc5d2f7bc970c07f

    SHA1

    a82190fc530c265aa40a045c21770d967f4767b8

    SHA256

    d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

    SHA512

    42e53d96e5961e95b7a984d9c9778a1d3bd8ee0c87b8b3b515fa31f67c2d073c8565afc2f4b962c43668c4efa1e478da9bb0ecffa79479c7e880731bc4c55765

  • memory/1340-0-0x0000000000660000-0x0000000000666000-memory.dmp

    Filesize

    24KB

  • memory/1340-1-0x0000000000660000-0x0000000000666000-memory.dmp

    Filesize

    24KB

  • memory/1340-2-0x0000000000790000-0x0000000000796000-memory.dmp

    Filesize

    24KB

  • memory/3960-19-0x0000000000670000-0x0000000000676000-memory.dmp

    Filesize

    24KB

  • memory/3960-17-0x0000000002090000-0x0000000002096000-memory.dmp

    Filesize

    24KB