Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/02/2024, 02:27

General

  • Target

    2024-02-25_2220829d980abd0ac0e2efcc96e03306_cryptolocker.exe

  • Size

    43KB

  • MD5

    2220829d980abd0ac0e2efcc96e03306

  • SHA1

    b7e945f0b4f49d2f71a78d06f3e8bface7acf59e

  • SHA256

    678cb015766ef42bfb1fb94f72dbe5c904aaea1ad99461b92d3447188c202fc8

  • SHA512

    c6d65ece8ccaa0d98746358a26f92602bfb2d550c0770227a5399f5589f9ad2f761105d5a3664f716ee77be1caab4469955a7766cc6e35bdf0180e7d5ec06296

  • SSDEEP

    768:btB9g/WItCSsAGjX7r3BPOMHocM4vUUOmJ+96eg1lL:btB9g/xtCSKfxLIcMzUw96DL

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-25_2220829d980abd0ac0e2efcc96e03306_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-25_2220829d980abd0ac0e2efcc96e03306_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4592
    • C:\Users\Admin\AppData\Local\Temp\gewos.exe
      "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      PID:4988

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\gewos.exe

    Filesize

    43KB

    MD5

    bd5c09f7c2dc540c17b343483cc483f4

    SHA1

    07d8d9da799d0bbb903db9f05f47ae31968a49af

    SHA256

    20a3d29a322bb13daf9e908a91ed1e932b3c9e36e828a71e3b34a6b02e6d2e5e

    SHA512

    17811433959f6132810ea8b4e8f066a5a86ed07d9ecd5c128f25fde7e6f8a21b6a93e65fc6ebf9ee6f8395be68f92c0a7ebbeea3e745653b9447249083eedaf1

  • memory/4592-0-0x0000000002340000-0x0000000002346000-memory.dmp

    Filesize

    24KB

  • memory/4592-1-0x0000000002340000-0x0000000002346000-memory.dmp

    Filesize

    24KB

  • memory/4592-2-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/4988-20-0x0000000002250000-0x0000000002256000-memory.dmp

    Filesize

    24KB