Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/03/2024, 21:28

General

  • Target

    2024-03-08_43f3fa31547c2b787ba6c3634bbcecaa_cryptolocker.exe

  • Size

    96KB

  • MD5

    43f3fa31547c2b787ba6c3634bbcecaa

  • SHA1

    f29b79763bf5f1831c4e22a579edc7f736ede7c5

  • SHA256

    73ccac633d692afe6a7924f2f6df065dbfb0b74beda218b4cc8810bbc620fa0a

  • SHA512

    e862f1eac609b86d700f9ffd0f08db209609acd620db4f47b211843e8a63fa2c392f4455036c07388f5550530ffa9fff5da8faad9a811f7408c8c4341bcc27d5

  • SSDEEP

    1536:V6QFElP6n+gMQMOtEvwDpjQGYQbN/PKwNgpwwJ:V6a+pOtEvwDpjtzI

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-08_43f3fa31547c2b787ba6c3634bbcecaa_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-08_43f3fa31547c2b787ba6c3634bbcecaa_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2428
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:4316

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    96KB

    MD5

    04f35f71189f764f55427600bb165211

    SHA1

    6fbd9924055f946261c91a629650b23cce4c4c58

    SHA256

    b6a86c18b1c5b22477b0a21ab65042340bd74c81a02087c7ef83719c7bfe1d4a

    SHA512

    2557e5c4efbf7649e4c24f40a196acf204d4f7e078d7d32f55f802cba7f852689d05ca8105fae4236c15d492ae758f35330941e3b59ecd68f70b656a58290f92

  • memory/2428-0-0x00000000005A0000-0x00000000005A6000-memory.dmp

    Filesize

    24KB

  • memory/2428-1-0x00000000005A0000-0x00000000005A6000-memory.dmp

    Filesize

    24KB

  • memory/2428-2-0x00000000005C0000-0x00000000005C6000-memory.dmp

    Filesize

    24KB

  • memory/4316-18-0x0000000000510000-0x0000000000516000-memory.dmp

    Filesize

    24KB

  • memory/4316-17-0x00000000004E0000-0x00000000004E6000-memory.dmp

    Filesize

    24KB