Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/02/2024, 15:21

General

  • Target

    2024-02-23_881d4b0e91b8b1636314a16c531de30d_cryptolocker.exe

  • Size

    40KB

  • MD5

    881d4b0e91b8b1636314a16c531de30d

  • SHA1

    9dcef4bc488e8924aa1624de2c2bf57d0352a110

  • SHA256

    e1a9999c6ac31caa1c159ee8b5a21c99b26e12568c3699799bd8e5c40786ef4e

  • SHA512

    476796356f4d6c3069537306c8bd91591856890c4740be65cc0b5688b9fdceb69fec7d6dc3d0842635ba377714be335ea36c1b4314e3f81215602f34f9052e0f

  • SSDEEP

    384:bAvMaNGh4z7CG3POOvbRSLoF/F0QU5XYFnufc/zzoiM8Nekdvjl9V50i3NbZM+iS:bAvJCYOOvbRPDEgXrNekd7l94i3p+kuG

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-23_881d4b0e91b8b1636314a16c531de30d_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-23_881d4b0e91b8b1636314a16c531de30d_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3024
    • C:\Users\Admin\AppData\Local\Temp\demka.exe
      "C:\Users\Admin\AppData\Local\Temp\demka.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      PID:4664

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\demka.exe

    Filesize

    41KB

    MD5

    b926b08addf312de3cb3ffb749dddfc6

    SHA1

    fde6d6aa35d891f512874ccf194f5fa5028b1407

    SHA256

    5be540a40ee88cf403d788883f3605cb09d9fd80e8018056c0faa4a66f80dbc7

    SHA512

    d94f00a600578ea4d19885cb525561947863028e7acc695899bc2b68952800b9fa0f061ad97c44e6010b6aeef95c7127ed4fae6a8a3135eff9eecaf23ead23e9

  • memory/3024-0-0x00000000022D0000-0x00000000022D6000-memory.dmp

    Filesize

    24KB

  • memory/3024-1-0x00000000022D0000-0x00000000022D6000-memory.dmp

    Filesize

    24KB

  • memory/3024-2-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/4664-22-0x0000000002020000-0x0000000002026000-memory.dmp

    Filesize

    24KB