Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/02/2024, 03:45

General

  • Target

    2024-02-29_67781002f7b29b76a50c9b8262ff79f5_cryptolocker.exe

  • Size

    53KB

  • MD5

    67781002f7b29b76a50c9b8262ff79f5

  • SHA1

    ee98e5b0231e73feb33998113b01ddf23e8e8a33

  • SHA256

    afc334399b3e3b44fb28b0f069c134ccf4149da03e4e187fe3036b40e1061d50

  • SHA512

    2f5db463ce9002396700ddcf2c31d40db89770a583ecdafc20d60e0ac176d3946cde7a2b2538b02e3c024085cc20aafc4166326f44c0bea0065fef2f1407b0e5

  • SSDEEP

    768:bIDOw9UiaCHfjnE0Sfa7ilR0p9u6p4ICNBCXK9XbTbmhTY:bIDOw9a0DwitDZzcTh

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-29_67781002f7b29b76a50c9b8262ff79f5_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-29_67781002f7b29b76a50c9b8262ff79f5_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4140
    • C:\Users\Admin\AppData\Local\Temp\lossy.exe
      "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
      2⤵
      • Executes dropped EXE
      PID:3052

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\lossy.exe

    Filesize

    53KB

    MD5

    c65d5bbe45e9cf2d5a3b3c3c36b82dac

    SHA1

    1b49976d2bc9ba4860956394798a24395e7a1157

    SHA256

    5de0c1f271bb738e56111716815eb7656c0e3a9383499121d5aaabf9a416e8c1

    SHA512

    288921a02f982e437483d0e28faefe770964c52b5004259193091a8ddef9c48a7e618a6517c4a073b0eef0e9751d8878984a95b4cc7b2c3a80b3dd46b257512c

  • memory/3052-17-0x00000000020E0000-0x00000000020E6000-memory.dmp

    Filesize

    24KB

  • memory/3052-19-0x00000000020C0000-0x00000000020C6000-memory.dmp

    Filesize

    24KB

  • memory/4140-0-0x0000000002280000-0x0000000002286000-memory.dmp

    Filesize

    24KB

  • memory/4140-1-0x0000000002280000-0x0000000002286000-memory.dmp

    Filesize

    24KB

  • memory/4140-2-0x0000000002170000-0x0000000002176000-memory.dmp

    Filesize

    24KB