Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/02/2024, 14:47

General

  • Target

    2024-02-18_cdfb7ef0c116dd9ec2409b337b56cee0_cryptolocker.exe

  • Size

    125KB

  • MD5

    cdfb7ef0c116dd9ec2409b337b56cee0

  • SHA1

    3946ab6c3169406bc7efa2e255c562bc125ce360

  • SHA256

    889abd290b440b07d6fbda9603893f221a04dbab168314f1a0798a3b63cfc934

  • SHA512

    bbdcdf65f0ce7dacb2e14bf1f9a0b33da8428eaeed37ad389341d438c104c4c20aefd8e2af60e55fd500ce560743ce71c662ac165de92bdfaabab930d87d453a

  • SSDEEP

    1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgp699GNtL1eU:AnBdOOtEvwDpj6za

Score
9/10
upx

Malware Config

Signatures

  • Detection of CryptoLocker Variants 4 IoCs
  • Detection of Cryptolocker Samples 4 IoCs
  • UPX dump on OEP (original entry point) 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-18_cdfb7ef0c116dd9ec2409b337b56cee0_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-18_cdfb7ef0c116dd9ec2409b337b56cee0_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:972
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:3480

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    126KB

    MD5

    4397bb2d1f5dc633010daef9ce5e1edc

    SHA1

    ce1ad5053d7325b49a7a67f385404c658d81cfb4

    SHA256

    f91892f625deebacf6f97962397bd41bfc88015cc3e13d8bdf450b24246a995a

    SHA512

    8cfb436a3caea64c4599742b585d8f4f6165a570f802724c1209cf917c5d4bfc06803568c77647cd2e35946867879d2fa3d166c27e82962d6daa17e58a03bb65

  • memory/972-0-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/972-1-0x0000000000570000-0x0000000000576000-memory.dmp

    Filesize

    24KB

  • memory/972-2-0x0000000000570000-0x0000000000576000-memory.dmp

    Filesize

    24KB

  • memory/972-3-0x0000000002070000-0x0000000002076000-memory.dmp

    Filesize

    24KB

  • memory/972-17-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/3480-20-0x00000000004D0000-0x00000000004D6000-memory.dmp

    Filesize

    24KB

  • memory/3480-19-0x00000000004F0000-0x00000000004F6000-memory.dmp

    Filesize

    24KB

  • memory/3480-26-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB