Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/02/2024, 04:24

General

  • Target

    2024-02-19_0aef9ae123a14b4ffea9613e6a5f3c0e_cryptolocker.exe

  • Size

    60KB

  • MD5

    0aef9ae123a14b4ffea9613e6a5f3c0e

  • SHA1

    5429d076a278e1bb6ea832e2017911e20a09f830

  • SHA256

    ea79111406ba792a66df20193615cf5af2181b2fefb8c779554ae78f1f9d847c

  • SHA512

    aa4501cf3fd097588bb41906106e73555dbf9055b8a01cd03c3a4df12a99432f8e15bb5aed563f49b290cc4df2f343a032c5251ec248f5f538d380133edb3090

  • SSDEEP

    1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMOJ:TCjsIOtEvwDpj5HE/OUHnSMF

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • Detection of Cryptolocker Samples 5 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-19_0aef9ae123a14b4ffea9613e6a5f3c0e_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-19_0aef9ae123a14b4ffea9613e6a5f3c0e_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4568
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Executes dropped EXE
      PID:4076

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    60KB

    MD5

    c12c57fd67d6f8f4f40021de94cbe5ba

    SHA1

    85e2a83b8d1aea6d22ab2f8efa22d79cdb30ec0b

    SHA256

    64b137588b363756d390b00d7b77af9bc52fb1b79ac003a7af0a86a94fbde049

    SHA512

    f22d56980e2a6f48c37a44f4846eaae27d74839cf813277a333234a9bb3c7bd03289ba704c61ce9124b184366a8aa9e30832bac3cd4f207efc7a32b5a7fd628a

  • memory/4076-18-0x0000000000500000-0x000000000050E000-memory.dmp

    Filesize

    56KB

  • memory/4076-20-0x00000000005C0000-0x00000000005C6000-memory.dmp

    Filesize

    24KB

  • memory/4076-22-0x00000000005A0000-0x00000000005A6000-memory.dmp

    Filesize

    24KB

  • memory/4076-27-0x0000000000500000-0x000000000050E000-memory.dmp

    Filesize

    56KB

  • memory/4568-0-0x0000000000500000-0x000000000050E000-memory.dmp

    Filesize

    56KB

  • memory/4568-1-0x0000000002310000-0x0000000002316000-memory.dmp

    Filesize

    24KB

  • memory/4568-2-0x0000000002310000-0x0000000002316000-memory.dmp

    Filesize

    24KB

  • memory/4568-3-0x0000000002210000-0x0000000002216000-memory.dmp

    Filesize

    24KB

  • memory/4568-17-0x0000000000500000-0x000000000050E000-memory.dmp

    Filesize

    56KB