Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/02/2024, 05:01

General

  • Target

    2024-02-25_9cf30125a29f02c6d3a578c31955304d_cryptolocker.exe

  • Size

    39KB

  • MD5

    9cf30125a29f02c6d3a578c31955304d

  • SHA1

    0cc1a801a90c91725aecba6b5830072b5bdece9e

  • SHA256

    048ba25ab37fd36bd1d357504d6e5f32c1fc9f6f8ac318aaeafbd831752381fa

  • SHA512

    e9c94b7ce674532a05135f34b821e4ad44210a0f19a5493eb2abbd06fe73cb6eef6223409004e73dde6c19fb800be57b90d4f7d264e64d7611f2db30e89768a4

  • SSDEEP

    768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjLenQLL1:ZzFbxmLPWQMOtEvwDpjLeU5

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-25_9cf30125a29f02c6d3a578c31955304d_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-25_9cf30125a29f02c6d3a578c31955304d_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1972
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Executes dropped EXE
      PID:456

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    39KB

    MD5

    12975329fd584e0ed1d90701be15181f

    SHA1

    6acd83f6739b2824bed284fbd88ff8b3b6fcbca2

    SHA256

    f0748e9d004bd9b6987e5a5fc705177b06eb0cd057394b717dc25584ddb11f0b

    SHA512

    74930e018df46855a038ac39133bcff000c1cf956233dba7663756a3b40f8184e6b940ec908525d9cc8524717ffc13deef4e4e2fa3f5ea29eb081c860923faf5

  • memory/456-19-0x0000000002100000-0x0000000002106000-memory.dmp

    Filesize

    24KB

  • memory/456-21-0x00000000020D0000-0x00000000020D6000-memory.dmp

    Filesize

    24KB

  • memory/456-26-0x00000000004F0000-0x00000000004F3000-memory.dmp

    Filesize

    12KB

  • memory/1972-0-0x00000000004E0000-0x00000000004E3000-memory.dmp

    Filesize

    12KB

  • memory/1972-1-0x0000000002320000-0x0000000002326000-memory.dmp

    Filesize

    24KB

  • memory/1972-2-0x0000000002320000-0x0000000002326000-memory.dmp

    Filesize

    24KB

  • memory/1972-3-0x0000000002230000-0x0000000002236000-memory.dmp

    Filesize

    24KB

  • memory/1972-17-0x00000000004E0000-0x00000000004E3000-memory.dmp

    Filesize

    12KB