Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/02/2024, 01:54

General

  • Target

    2024-02-23_c8c47bbe15ddb306d145294faa77a015_cryptolocker.exe

  • Size

    66KB

  • MD5

    c8c47bbe15ddb306d145294faa77a015

  • SHA1

    cd99f1c72c3b89ea1e341be3921cff037df1d00b

  • SHA256

    c9037d56250b2d6a329b4ac71ca28ad0abbc764f46c19ef9ed5e856eff9e3f13

  • SHA512

    6b3bacfb8b3c529cdb0a85ccea9ad9f790179eab0517b06284d848777f6739774461e4c314061491a6b71fb291eafb3faaa69771292dea6f9d7c899fab507d61

  • SSDEEP

    1536:P8mnK6QFElP6n+gymddpMOtEvwDpjY6UncY:1nK6a+qdOOtEvwDpjc

Score
9/10
upx

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • Detection of Cryptolocker Samples 5 IoCs
  • UPX dump on OEP (original entry point) 5 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-23_c8c47bbe15ddb306d145294faa77a015_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-23_c8c47bbe15ddb306d145294faa77a015_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:772
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:2908

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    66KB

    MD5

    d83a7d54e4f403913ed00b488320428b

    SHA1

    7eb7df0ea8fddbd684b0b53ecf7348838d8b39ab

    SHA256

    6702871a46e614588eb02be1c5a7ae9867af9d41fb7ce3a2bd87a5518f194094

    SHA512

    88d0281d01f317e53d1b4b38fc22c91fb75d0379cde2dd84d7384a31dfedc5c242ee43b76426ad89e56e9a6ada23325944883d2bd6e678e01534054ae9ccfeb1

  • memory/772-0-0x0000000000500000-0x000000000050F311-memory.dmp

    Filesize

    60KB

  • memory/772-1-0x0000000002210000-0x0000000002216000-memory.dmp

    Filesize

    24KB

  • memory/772-2-0x0000000002210000-0x0000000002216000-memory.dmp

    Filesize

    24KB

  • memory/772-3-0x0000000002230000-0x0000000002236000-memory.dmp

    Filesize

    24KB

  • memory/772-18-0x0000000000500000-0x000000000050F311-memory.dmp

    Filesize

    60KB

  • memory/2908-17-0x0000000000500000-0x000000000050F311-memory.dmp

    Filesize

    60KB

  • memory/2908-20-0x0000000000510000-0x0000000000516000-memory.dmp

    Filesize

    24KB

  • memory/2908-21-0x00000000004D0000-0x00000000004D6000-memory.dmp

    Filesize

    24KB

  • memory/2908-27-0x0000000000500000-0x000000000050F311-memory.dmp

    Filesize

    60KB