Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/02/2024, 22:29

General

  • Target

    2024-02-28_b056add30610287691460e958096422e_cryptolocker.exe

  • Size

    46KB

  • MD5

    b056add30610287691460e958096422e

  • SHA1

    efe351130ebe79c8eb4c081b8588e5e4499339a1

  • SHA256

    f25d40e1767be77e4145cb59c1e45634c7e8c81d641c53a975f2635e63245934

  • SHA512

    422ddcad4e0205fe5511118d40aa12c047d827867e189cb174a76fe2409480e78d2eba398e79ce3426edf28472265c0d614bee4f7dc44c736857e26ca93bc322

  • SSDEEP

    768:btB9g/WItCSsAGjX7r3BPOMHoc/QQJP5q4X:btB9g/xtCSKfxLIc/C4X

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-28_b056add30610287691460e958096422e_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-28_b056add30610287691460e958096422e_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2780
    • C:\Users\Admin\AppData\Local\Temp\gewos.exe
      "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      PID:3580

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\gewos.exe

    Filesize

    46KB

    MD5

    72e9c75a76f42a8be3476094b2e50760

    SHA1

    cca413d6157f71d9fec6a07046e0b6c9217452d2

    SHA256

    5c0e3e79e6ac56913ccdb7e62dada19914e2c1af67edb4ab625f48f397a48c0e

    SHA512

    c3bded32c88da5613dc04832aa3378306c3955d647602d7e5b3b761bf9322c73387cc1a9958d6baf55829fd5e1128ea85654fa13a811f3c290b683b3d2433231

  • memory/2780-0-0x00000000021E0000-0x00000000021E6000-memory.dmp

    Filesize

    24KB

  • memory/2780-1-0x00000000021E0000-0x00000000021E6000-memory.dmp

    Filesize

    24KB

  • memory/2780-2-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/3580-22-0x00000000020A0000-0x00000000020A6000-memory.dmp

    Filesize

    24KB