Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/02/2024, 14:39

General

  • Target

    2024-02-21_6f65e2e9ddbe641941a9eaf31de78985_cryptolocker.exe

  • Size

    30KB

  • MD5

    6f65e2e9ddbe641941a9eaf31de78985

  • SHA1

    c789da7ee3629b9d25a29c4fd9a33f8e25cb6c02

  • SHA256

    0b60586e12c271aaff1bae59199fcd911cf01272fec233e3a99cfc837be2dc6c

  • SHA512

    0a829dcceaa5cd6ee49b2da65d6cf8aa81ee69740d4931f78efc954c450fa0c3db03003c1dfd69a4783641dacdc89e9cf7751dcae439be5781503d3c408030d0

  • SSDEEP

    384:bA74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUr766SJ/Tl+6lt65W:bA74zYcgT/Ekd0ryfjQRSlpltt

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-21_6f65e2e9ddbe641941a9eaf31de78985_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-21_6f65e2e9ddbe641941a9eaf31de78985_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1784
    • C:\Users\Admin\AppData\Local\Temp\hasfj.exe
      "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
      2⤵
      • Executes dropped EXE
      PID:4240

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\hasfj.exe

    Filesize

    30KB

    MD5

    996f2eeb12087e59824ce5ccdc0d7306

    SHA1

    24cfb17329ceb429bb5823827281f522698540bd

    SHA256

    96d1fdd20c58565278c4c9ccab4ff3d9400fbbd0e069634986b20221f4140ec3

    SHA512

    1be82398692ce3ea96b86b6747e8678e2c12190b92fb87aa738feba44461e46dc2e7dcba780120d047b64451c2770d96e07a03c9c8cc1e47d93915c0432573d4

  • memory/1784-0-0x00000000022C0000-0x00000000022C6000-memory.dmp

    Filesize

    24KB

  • memory/1784-1-0x00000000022C0000-0x00000000022C6000-memory.dmp

    Filesize

    24KB

  • memory/1784-2-0x0000000002340000-0x0000000002346000-memory.dmp

    Filesize

    24KB

  • memory/4240-17-0x0000000002ED0000-0x0000000002ED6000-memory.dmp

    Filesize

    24KB

  • memory/4240-22-0x0000000002120000-0x0000000002126000-memory.dmp

    Filesize

    24KB