Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/03/2024, 17:28

General

  • Target

    2024-03-13_29fd85812752fc3a840e0034aaf74a7b_cryptolocker.exe

  • Size

    104KB

  • MD5

    29fd85812752fc3a840e0034aaf74a7b

  • SHA1

    a6a025e3a04729c67c66718ecd6e2482eec9ca91

  • SHA256

    14bc665e0494a2b1f786974ad0c9641c7c093a792a7539dc2cb91079b87228f9

  • SHA512

    20ff2330387e4257b28941619aa8870483695e75ec907e22745d19487de543a02c59a4a90530ca2114465cbfcd1ea79f2399bc20dacecd3ed4540a3c799e14a8

  • SSDEEP

    1536:V6QFElP6n+gMQMOtEvwDpjQGYQbN/PKwNgpQbCJhHg:V6a+pOtEvwDpjtzJ

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-13_29fd85812752fc3a840e0034aaf74a7b_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-13_29fd85812752fc3a840e0034aaf74a7b_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1304
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:2908

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    105KB

    MD5

    c2a843cf933fdf0694d6637f4aae6391

    SHA1

    a88284554769ade76ec93065ecd5d49691c575bd

    SHA256

    d39c274e7d754a0253c327827f7c8f70e4e455970021182c3a4c0363c6ceea75

    SHA512

    9d2f674fd4711fd760c3c45a8c511cba33a629090ada70aaf1d070fa07aa152c8946d17e91b8554393c57fc285ee092c49c2a6d4168dc1c8189dac2e39275b70

  • memory/1304-0-0x00000000006A0000-0x00000000006A6000-memory.dmp

    Filesize

    24KB

  • memory/1304-1-0x00000000006A0000-0x00000000006A6000-memory.dmp

    Filesize

    24KB

  • memory/1304-2-0x00000000006C0000-0x00000000006C6000-memory.dmp

    Filesize

    24KB

  • memory/2908-17-0x00000000020E0000-0x00000000020E6000-memory.dmp

    Filesize

    24KB

  • memory/2908-23-0x00000000020C0000-0x00000000020C6000-memory.dmp

    Filesize

    24KB