Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

17/02/2024, 13:27

240217-qp27lsfg88 7

17/02/2024, 13:22

240217-qmqqssfc6s 10

Analysis

  • max time kernel
    90s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/02/2024, 13:22

General

  • Target

    2024-02-17_0776f0973edab7f367679e0e4763c01c_cryptolocker.exe

  • Size

    36KB

  • MD5

    0776f0973edab7f367679e0e4763c01c

  • SHA1

    a9a61eebdc28193af7535fc141b74bb4242b9f3f

  • SHA256

    52b02a2558db793cd4fbbf614858899c18e7aa103d3750d786d8bbbaa5c84487

  • SHA512

    2d02670bd96272dbd52f7961867f03f2ff736e1768f56293cd9fd9334e5d18be3e74234a4d23a9d36de8c3adca98ccd9f546d30706c76049a3c771b9e852f8dc

  • SSDEEP

    384:bAvMaNGh4z7CG3POOvbRSLoF/F0QU5XYFnufc/zzoiM8Nekdvjl9V50i3Nbin:bAvJCYOOvbRPDEgXrNekd7l94i3pin

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-17_0776f0973edab7f367679e0e4763c01c_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-17_0776f0973edab7f367679e0e4763c01c_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3736
    • C:\Users\Admin\AppData\Local\Temp\demka.exe
      "C:\Users\Admin\AppData\Local\Temp\demka.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      PID:3812

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\demka.exe

    Filesize

    36KB

    MD5

    1f5ace5c55faa846a935c28935832be4

    SHA1

    e867e8268ab298cffdc9832a90e933a0ca32523b

    SHA256

    322759ff2487ec489e5abb132f4d58867322308fe6e744763b0ab000791d6f22

    SHA512

    d25ef5e1c2a796000649354a181b25d67b7906e05e1974389219fafc87b10f1a6fcc9d1711c6e19254293bdc90d3aab5e44704c126fc58b440f9279e297979d2

  • memory/3736-0-0x0000000002260000-0x0000000002266000-memory.dmp

    Filesize

    24KB

  • memory/3736-1-0x0000000002260000-0x0000000002266000-memory.dmp

    Filesize

    24KB

  • memory/3736-2-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/3812-20-0x0000000002D60000-0x0000000002D66000-memory.dmp

    Filesize

    24KB