Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    171s
  • max time network
    183s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/03/2024, 09:52

General

  • Target

    2024-03-10_f8708d184ab613226c80a2715e8e4af3_cryptolocker.exe

  • Size

    58KB

  • MD5

    f8708d184ab613226c80a2715e8e4af3

  • SHA1

    e20fcc78028ce77ce7d4c210a1060c911f3eae69

  • SHA256

    84b2eacf23ff79ca2d81a1ff905d9ca23c5eeaf2e9df195db7c3615c4a9fca4f

  • SHA512

    c7bdce7d062ab5498b36f7e764c3be8c0fa42415ae1d3b290ed65ee5995dbd5933462b936feab94cefd334756c8b9a27844856c6324081d139d134ab7f4a6320

  • SSDEEP

    768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpj/MLa5VccPt547/2VoJ:V6QFElP6n+gMQMOtEvwDpjyaLccVCbH

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-10_f8708d184ab613226c80a2715e8e4af3_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-10_f8708d184ab613226c80a2715e8e4af3_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1096
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:3968

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    58KB

    MD5

    359a07b603a791c13c304479b5d812e7

    SHA1

    b5555621d0af127266165e453f4209d635b6962e

    SHA256

    8c2d75afe52ec37e66a4420bb948467a47562aef8dae74a72ef8051076a51118

    SHA512

    c4beba1e06751a267a06722deb54e62a5cc6e41a50d1ac2c811004ac4d740d11e9907b8dca5196cea7e668242c2422db9ff16abc36ffab0f27dc072dee7adc67

  • memory/1096-0-0x00000000006A0000-0x00000000006A6000-memory.dmp

    Filesize

    24KB

  • memory/1096-1-0x00000000006A0000-0x00000000006A6000-memory.dmp

    Filesize

    24KB

  • memory/1096-2-0x00000000006C0000-0x00000000006C6000-memory.dmp

    Filesize

    24KB

  • memory/3968-17-0x0000000002100000-0x0000000002106000-memory.dmp

    Filesize

    24KB

  • memory/3968-20-0x00000000006B0000-0x00000000006B6000-memory.dmp

    Filesize

    24KB