Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/02/2024, 13:44

General

  • Target

    2024-02-25_c5d06455cc1b129d310cf05246f6d6d5_cryptolocker.exe

  • Size

    41KB

  • MD5

    c5d06455cc1b129d310cf05246f6d6d5

  • SHA1

    56d72f6c67f842cc01f68385678b755d1411e4d4

  • SHA256

    6aa33d47b1f86f4c4f54e4ce219a368f57d4356e4417bdd90734ab8bdf2ed437

  • SHA512

    cfa64c11c405d6ea0d05853d343b72351b7a577b8e90ceadc546df111ed792bb61e6d54ddd32b386085bb13e4a8f83353b760ecc31b261a73dd2a05e6e900a42

  • SSDEEP

    768:bIDOw9UiaCHfjnE0Sf88AvvP1oghYvm9/6Dy8POKXuy:bIDOw9a0Dwo3P1ojvUSDh1L

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-25_c5d06455cc1b129d310cf05246f6d6d5_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-25_c5d06455cc1b129d310cf05246f6d6d5_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3300
    • C:\Users\Admin\AppData\Local\Temp\lossy.exe
      "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
      2⤵
      • Executes dropped EXE
      PID:3564

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\lossy.exe

    Filesize

    41KB

    MD5

    e8c0657105af6624ea09579a56362692

    SHA1

    c8be270e859ab5b90ef0f2cfbda34930821b7576

    SHA256

    5b28727880d8f22472e48f927920e896612b824f4dbbe44ad9dbb4337a693d3d

    SHA512

    f7a8f209772bd408a06f12b4adc1baac3a798f0d67e2c19b2ea18196fbe7e723eb233155ea861b5f028617a0f69ef5c311895caafb98a42bc843277ce9619f0c

  • memory/3300-0-0x00000000005E0000-0x00000000005E6000-memory.dmp

    Filesize

    24KB

  • memory/3300-1-0x00000000005E0000-0x00000000005E6000-memory.dmp

    Filesize

    24KB

  • memory/3300-2-0x0000000002220000-0x0000000002226000-memory.dmp

    Filesize

    24KB

  • memory/3564-18-0x00000000020F0000-0x00000000020F6000-memory.dmp

    Filesize

    24KB

  • memory/3564-17-0x0000000001FC0000-0x0000000001FC6000-memory.dmp

    Filesize

    24KB