Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/03/2024, 05:45

General

  • Target

    2024-03-06_425b94b806b9d7c8cf51996942cd664f_cryptolocker.exe

  • Size

    42KB

  • MD5

    425b94b806b9d7c8cf51996942cd664f

  • SHA1

    fccc120ed590521bdfd4cc9723a02c1ac724bbc0

  • SHA256

    c2b1487ff0cae649a5eb3fc0c0fafc9a8188ca0de838e045cebd81b90637ed7f

  • SHA512

    438b9b0deeeaedc5636c536a9a4b90eb92451fdf3756fc8657a8a67f8774bc2365a97fd702c4ccb656fd949f99010c9c3bd7cd6e1e6f45a9891e206294179341

  • SSDEEP

    768:b7o/2n1TCraU6GD1a4X0WcO+wMVm+slAMphej6J:bc/y2lkF0+Bex

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-06_425b94b806b9d7c8cf51996942cd664f_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-06_425b94b806b9d7c8cf51996942cd664f_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4896
    • C:\Users\Admin\AppData\Local\Temp\rewok.exe
      "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
      2⤵
      • Executes dropped EXE
      PID:4492
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4472 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:4592

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\rewok.exe

      Filesize

      43KB

      MD5

      3580ee487f626bfca527aeb6c8e0c1a7

      SHA1

      96c2ce3803c9d4e392f8246c1368ac7b0d3e95e8

      SHA256

      a59474c638947c05f23d546f6725b6db8fee8b31083161fa52d0b67fe189fbe8

      SHA512

      06e1c38d15291df780ef8c0cebc0eae0001b9e095be239491c5bbddab4433448232d9c4b37111d35e562bb4806cddd293b628239ccd94f15cb58e0c4e1aeb94a

    • memory/4492-20-0x0000000001F70000-0x0000000001F76000-memory.dmp

      Filesize

      24KB

    • memory/4896-0-0x0000000002260000-0x0000000002266000-memory.dmp

      Filesize

      24KB

    • memory/4896-1-0x0000000002260000-0x0000000002266000-memory.dmp

      Filesize

      24KB

    • memory/4896-2-0x0000000000400000-0x0000000000406000-memory.dmp

      Filesize

      24KB