Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/02/2024, 00:57

General

  • Target

    2024-02-29_e72b5bd884e71b41df663304f0e4c5bd_cryptolocker.exe

  • Size

    40KB

  • MD5

    e72b5bd884e71b41df663304f0e4c5bd

  • SHA1

    ba017c9c6e67ad137749ab364cd8583f2d2e0518

  • SHA256

    0dcb6900a6b351ab847ac83dd756fe22e69a6030794517df5e1a6d3c1f8fa4d6

  • SHA512

    19b59f21f20a0a5d3853b63760e44720853a36a20665a6608b60896b65abb93bd656e96c90d3f21926e42e269a07920c61074c0c021fd6e99f24d7a0c6011112

  • SSDEEP

    768:bAvJCYOOvbRPDEgXrNekd7l94i3py/yY/m:bAvJCF+RQgJeab4sy/lm

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-29_e72b5bd884e71b41df663304f0e4c5bd_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-29_e72b5bd884e71b41df663304f0e4c5bd_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4740
    • C:\Users\Admin\AppData\Local\Temp\demka.exe
      "C:\Users\Admin\AppData\Local\Temp\demka.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      PID:2816

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\demka.exe

    Filesize

    40KB

    MD5

    22dc6ccbfb470ea965c740fbc0205438

    SHA1

    f96d73f6ae1622c22a5f843d6966da8b0fddba79

    SHA256

    ac3942a2f1e2067984edcdb157a9f7a12d4fd4ba3ccaaea0e0d690e4086b139b

    SHA512

    a841ffb8ff31bf6e10835515ea4c6b009c9ff62967a38a09e68c11e07dc14f17149803c7c84fa63f09be341822f4d5a0822dca3dab4ad3a225108858199bfb64

  • memory/2816-20-0x0000000002D60000-0x0000000002D66000-memory.dmp

    Filesize

    24KB

  • memory/4740-0-0x0000000000730000-0x0000000000736000-memory.dmp

    Filesize

    24KB

  • memory/4740-1-0x0000000000730000-0x0000000000736000-memory.dmp

    Filesize

    24KB

  • memory/4740-2-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB