Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/03/2024, 07:44

General

  • Target

    2024-03-15_f2431586095eec09b4dc66095383e338_cryptolocker.exe

  • Size

    72KB

  • MD5

    f2431586095eec09b4dc66095383e338

  • SHA1

    8331756fbf4368dee0fc073360166146133a0f5d

  • SHA256

    cbe0941ae3c266dcfdbe4e30e6018d04aa832cee094031979a7ff4de7e319c08

  • SHA512

    b1e6caeed6ebf50ff439ffd847f9f5d8c449b315ded934b238c7c96fc9203bd4b12d86dafb4d8d51ad078e884a19833b1e8bac3754dd64cab31acbbd8181d677

  • SSDEEP

    1536:ZzFbxmLPWQMOtEvwDpj386Sj/WprgJN6tZdOyJ3KUU:ZVxkGOtEvwDpjcaw

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-15_f2431586095eec09b4dc66095383e338_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-15_f2431586095eec09b4dc66095383e338_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4972
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Executes dropped EXE
      PID:1872

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    72KB

    MD5

    3b18d86fcc67d66aac07532310e31512

    SHA1

    bf7831f2353051297341b7f8ee01c460754c6555

    SHA256

    d16ea58fd05e3f6bf44019b2560da98ed4772ebf6094ab6ce5108b6a52fc4c10

    SHA512

    65ebe0c3f616535e107cd82df588b3cacac02e7a1a8d584259353e5378adc367225caca29c575420cbdc371933658a74a7e5c980f3627bad74dca47e501e692c

  • memory/1872-21-0x0000000002110000-0x0000000002116000-memory.dmp

    Filesize

    24KB

  • memory/1872-20-0x00000000004F0000-0x00000000004F6000-memory.dmp

    Filesize

    24KB

  • memory/1872-19-0x00000000004A0000-0x00000000004A3000-memory.dmp

    Filesize

    12KB

  • memory/4972-0-0x00000000004E0000-0x00000000004E3000-memory.dmp

    Filesize

    12KB

  • memory/4972-2-0x0000000000670000-0x0000000000676000-memory.dmp

    Filesize

    24KB

  • memory/4972-1-0x0000000000670000-0x0000000000676000-memory.dmp

    Filesize

    24KB

  • memory/4972-3-0x0000000000690000-0x0000000000696000-memory.dmp

    Filesize

    24KB

  • memory/4972-17-0x00000000004E0000-0x00000000004E3000-memory.dmp

    Filesize

    12KB