Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/02/2024, 02:23

General

  • Target

    2024-02-23_1a8da4bf2decb881717e0ad5dbb26ef8_cryptolocker.exe

  • Size

    68KB

  • MD5

    1a8da4bf2decb881717e0ad5dbb26ef8

  • SHA1

    2a79c30b6430ad10cc36d9bcad22b399e978808c

  • SHA256

    7463739c1f8a76bb17ccdd3545c039fbeb1bf6206226d1785ec6da6f6b8ad6c7

  • SHA512

    95c1bc82b2d7ee313c737a791d825f80df188e82d8e2f03e027cd728b3774137aa400dea33f38da63bf6787a61474f628ead11f470e396c9e16a09bceda23847

  • SSDEEP

    1536:Dk/xY0sllyGQMOtEvwDpjwycDtKkQZQRKb61vSbgZ3QzNKU8:DW60sllyWOtEvwDpjwF85O

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 4 IoCs
  • Detection of Cryptolocker Samples 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-23_1a8da4bf2decb881717e0ad5dbb26ef8_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-23_1a8da4bf2decb881717e0ad5dbb26ef8_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1040
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:1480

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    68KB

    MD5

    74779734561ee86159bb43288d777952

    SHA1

    bd0d5e0d3ef4b7116d7736680f475aeb8fb030e2

    SHA256

    1811961c358ebbc9923a9932d2dc10335be698a27a247f4af32f8cf1ede5c156

    SHA512

    f78313b62eb7dc066205706ccf947f146cf3c68965ee86d340da55145c4a0f5f58066e79aa6fe7a664043d2047cf0c0582107774e367493d991bf94bcb529c57

  • memory/1040-0-0x0000000000500000-0x000000000050B000-memory.dmp

    Filesize

    44KB

  • memory/1040-1-0x00000000004D0000-0x00000000004D6000-memory.dmp

    Filesize

    24KB

  • memory/1040-2-0x00000000004D0000-0x00000000004D6000-memory.dmp

    Filesize

    24KB

  • memory/1040-3-0x00000000004F0000-0x00000000004F6000-memory.dmp

    Filesize

    24KB

  • memory/1040-18-0x0000000000500000-0x000000000050B000-memory.dmp

    Filesize

    44KB

  • memory/1480-17-0x0000000000500000-0x000000000050B000-memory.dmp

    Filesize

    44KB

  • memory/1480-21-0x0000000001F50000-0x0000000001F56000-memory.dmp

    Filesize

    24KB

  • memory/1480-20-0x0000000001F70000-0x0000000001F76000-memory.dmp

    Filesize

    24KB