Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/02/2024, 04:55

General

  • Target

    2024-02-29_63d967c274b12a6a4eb8ec4fb13ddbe7_cryptolocker.exe

  • Size

    126KB

  • MD5

    63d967c274b12a6a4eb8ec4fb13ddbe7

  • SHA1

    87f3007392aeaa056fb508e245123bde0772b0b8

  • SHA256

    dbd019d2130295ba7b274640fd58e6385f75566f3c695a4aa680e585b249f895

  • SHA512

    51bcd83703f426065a468e1cec492c89dd7b480bc2ef60fdbbd93da2d001fd2e7ca1687ba507ca1ba4c8c223f83f12d298c8bb9ccbace943c25bd09a03b7152e

  • SSDEEP

    1536:gUj+AIMOtEvwDpjNbwQEIPlemUhYwkkxGBxL:vCA9OtEvwDpjv

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-29_63d967c274b12a6a4eb8ec4fb13ddbe7_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-29_63d967c274b12a6a4eb8ec4fb13ddbe7_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:228
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      PID:1612

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    126KB

    MD5

    1bfbe3f9417bfef73224b3813e480f48

    SHA1

    1374f656e39cecef9f66222026818518c53c6e21

    SHA256

    32df70c14227dabad227092047a2ccc8f0530905dbd5795af0a1f798be1b94c6

    SHA512

    e60d4e8ee8fe8421c265cb502fd9950a4d234c784453b85a3a719bc149750c891d1ef96b343915334e3e485cb1cd3fe10762c25f15b04d8b9d0a8cc272b35837

  • memory/228-0-0x00000000004D0000-0x00000000004D6000-memory.dmp

    Filesize

    24KB

  • memory/228-1-0x00000000004D0000-0x00000000004D6000-memory.dmp

    Filesize

    24KB

  • memory/228-2-0x0000000002080000-0x0000000002086000-memory.dmp

    Filesize

    24KB

  • memory/1612-17-0x00000000006C0000-0x00000000006C6000-memory.dmp

    Filesize

    24KB

  • memory/1612-22-0x00000000006A0000-0x00000000006A6000-memory.dmp

    Filesize

    24KB