Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/03/2024, 23:50

General

  • Target

    2024-03-15_ddafa08936f838b753d2f1be45e6f14f_cryptolocker.exe

  • Size

    47KB

  • MD5

    ddafa08936f838b753d2f1be45e6f14f

  • SHA1

    57a7f860c5e9b698b49ed43a665c2412670e1f07

  • SHA256

    ac6376653eab09aa136b7eb02d2196b8b173109d633f31a52e28c3c2175998bd

  • SHA512

    69ccb51a5a487f8698c3f7eb43641fd181d41bd0cfa615037cf1c55048e828b1205fe5a45e5631b180f2f305f058fb0325fa320774a46e55c1d918ff654fccd6

  • SSDEEP

    768:bgX4zYcgTEu6QOaryfjqDlC6JFbK37YbDu5z/hvvkuD:bgGYcA/53GAA6y37nbrD

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-15_ddafa08936f838b753d2f1be45e6f14f_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-15_ddafa08936f838b753d2f1be45e6f14f_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4044
    • C:\Users\Admin\AppData\Local\Temp\hasfj.exe
      "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
      2⤵
      • Executes dropped EXE
      PID:2564

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\hasfj.exe

    Filesize

    48KB

    MD5

    26c9513d518116dd27951449c34564a4

    SHA1

    878d6f24804db04499d048d02d32709ddc0e5d82

    SHA256

    e04e2ee324d971c563b8926e9f9baeae2879dd8bb81329c60ca23a87f3e21aef

    SHA512

    910e8ceceb81cb48e1f5b309a051627491fc028556bf6be6d0f72a1efef68c2473915ac7389a5e51ea5004b2ad4762743f389ea327a1fc34b7968fd595c4e3c0

  • memory/2564-17-0x0000000003010000-0x0000000003016000-memory.dmp

    Filesize

    24KB

  • memory/2564-23-0x0000000002D60000-0x0000000002D66000-memory.dmp

    Filesize

    24KB

  • memory/4044-0-0x0000000000630000-0x0000000000636000-memory.dmp

    Filesize

    24KB

  • memory/4044-1-0x0000000000630000-0x0000000000636000-memory.dmp

    Filesize

    24KB

  • memory/4044-2-0x0000000000670000-0x0000000000676000-memory.dmp

    Filesize

    24KB