Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/02/2024, 08:43

General

  • Target

    2024-02-24_5f0de26233ce5e3ca3a99f24e5d21e27_cryptolocker.exe

  • Size

    124KB

  • MD5

    5f0de26233ce5e3ca3a99f24e5d21e27

  • SHA1

    0d7f62d4ded65db2fceb0e378829e80df91ae029

  • SHA256

    96313951bec6321631e8ecc17435adc0de7848dfadab3ae351b8dceb04f2f35f

  • SHA512

    0bf7e963bdd82685d5f30297066842a7ca0881d49c2b403225ee8e3424e9f7588f32fe3a9debadb49a445f762c78ca343893e436fe900cdf640961f014731fe8

  • SSDEEP

    1536:gUj+AIMOtEvwDpjNbwQEIPlemUhYwkkxE4f:vCA9OtEvwDpjm

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-24_5f0de26233ce5e3ca3a99f24e5d21e27_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-24_5f0de26233ce5e3ca3a99f24e5d21e27_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3556
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Executes dropped EXE
      PID:4868

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    124KB

    MD5

    249f826b243ba2a97d277ae0a2ebe858

    SHA1

    e4d7e9471f251504274c6c541afcc7ec716ffadb

    SHA256

    dfdc242df2c25d80e7bb2035d4c8d81105b60ca1bf90f92fb2e21fa3c7867323

    SHA512

    57bab10541e6d64d412b2136878bdd0a13245631b6ad3b88211ed4f86a92408dd0e27ed09d188bd2434a72e1d09327468722fe0af394f87ad84937145865456d

  • memory/3556-0-0x0000000000690000-0x0000000000696000-memory.dmp

    Filesize

    24KB

  • memory/3556-1-0x0000000000690000-0x0000000000696000-memory.dmp

    Filesize

    24KB

  • memory/3556-2-0x00000000006B0000-0x00000000006B6000-memory.dmp

    Filesize

    24KB

  • memory/4868-17-0x00000000004E0000-0x00000000004E6000-memory.dmp

    Filesize

    24KB

  • memory/4868-19-0x00000000004C0000-0x00000000004C6000-memory.dmp

    Filesize

    24KB