Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/03/2024, 19:53

General

  • Target

    2024-03-10_9fcd5498c6e548e0ea5ea514d45fe972_cryptolocker.exe

  • Size

    386KB

  • MD5

    9fcd5498c6e548e0ea5ea514d45fe972

  • SHA1

    9ae78f5386a1553395639bbda42c2d73e64e85f5

  • SHA256

    1024d349ecbedd52890fb7512e3a868137557d901be47038d1d6f4d5539025d0

  • SHA512

    1a35a1c9802ea7fa00d3ecb90fe109c9eef34c2d18496293f8e9024f5b7e8ba65eb52903820276876be816d4c5e01730794dd2a6c4373d9a4527bd51f2f9ec4f

  • SSDEEP

    6144:nnOsaQgAOjvrZFODJjBz3j1jTqQy6v2GGnugOtihzXX:nnOflT/ZFIjBz3xjTxynGUOUhXX

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-10_9fcd5498c6e548e0ea5ea514d45fe972_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-10_9fcd5498c6e548e0ea5ea514d45fe972_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4908
    • C:\Users\Admin\AppData\Local\Temp\hasfj.exe
      "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
      2⤵
      • Executes dropped EXE
      PID:1428

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\hasfj.exe

    Filesize

    386KB

    MD5

    99d62df0be50b76ff361f4387b759638

    SHA1

    d1fc69500b8ced87be12dba6d0b162f1a04e1885

    SHA256

    a5640ee210831de8175225cf6ee77c3d3cfa2c7a17bdefd6d2bd72822b0a25ae

    SHA512

    f198bb7f21352ef32c763469190f782b18ea60b0f2f3e0f0cefbd32651a5c418557e8c50a32a8cc28eb8b4db6a5c70fdfe05a1beef1346a1b855526669608b29

  • memory/1428-17-0x0000000002270000-0x0000000002276000-memory.dmp

    Filesize

    24KB

  • memory/1428-21-0x0000000000670000-0x0000000000676000-memory.dmp

    Filesize

    24KB

  • memory/4908-0-0x00000000007C0000-0x00000000007C6000-memory.dmp

    Filesize

    24KB

  • memory/4908-1-0x00000000007C0000-0x00000000007C6000-memory.dmp

    Filesize

    24KB

  • memory/4908-2-0x0000000002300000-0x0000000002306000-memory.dmp

    Filesize

    24KB