Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/03/2024, 05:30

General

  • Target

    2024-03-09_6f34ff0c570eedc111e44e13e283e44a_cryptolocker.exe

  • Size

    77KB

  • MD5

    6f34ff0c570eedc111e44e13e283e44a

  • SHA1

    c960b0d100fc9629a579ba203d3a22d73e5efdea

  • SHA256

    a634c5c7df4d9315447560e702805a9660448987eabae1b0935777d3fa656342

  • SHA512

    b869a03cc651aef3ef07fd716eafa75e3020c8bfcfab43ff3402caf8e3a7446775893974112d5916304eb432a8e4187c78cdba0f5cdaf822645c7024ff0c5c4e

  • SSDEEP

    1536:vj+jsMQMOtEvwDpj5HwYYTjipvF2hBfIuf1:vCjsIOtEvwDpj5H9YvQd2x

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-09_6f34ff0c570eedc111e44e13e283e44a_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-09_6f34ff0c570eedc111e44e13e283e44a_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2372
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Executes dropped EXE
      PID:3308
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3376 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:1140

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\misid.exe

      Filesize

      77KB

      MD5

      dbf33dfda1fbfaf71b3711303034f6a0

      SHA1

      857d65aa656a8f8f579519df0a59f4e8000a3114

      SHA256

      f4884969a258f6c1517123db479d61e971df27a07ea7f4c491e9376094a3e236

      SHA512

      b099933cbb546fb5165fbbfa112242c5651dbe781f9eeb40be88c398be31405a394ef079ebfd5b6d462f6bf49ebaaf0d29c7eaf7e4aeeda480dc6bb8caf21e2c

    • memory/2372-0-0x0000000000670000-0x0000000000676000-memory.dmp

      Filesize

      24KB

    • memory/2372-1-0x0000000000670000-0x0000000000676000-memory.dmp

      Filesize

      24KB

    • memory/2372-2-0x0000000002230000-0x0000000002236000-memory.dmp

      Filesize

      24KB

    • memory/3308-17-0x00000000020F0000-0x00000000020F6000-memory.dmp

      Filesize

      24KB

    • memory/3308-18-0x00000000005A0000-0x00000000005A6000-memory.dmp

      Filesize

      24KB