Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/03/2024, 13:41

General

  • Target

    2024-03-15_5dde0a380d252e4e51272f8754a983e1_cryptolocker.exe

  • Size

    37KB

  • MD5

    5dde0a380d252e4e51272f8754a983e1

  • SHA1

    dae1b1c82a1c2d7ca421d1c5ba3879f2f35dc275

  • SHA256

    f11ccb535657b25fc559bcf11c2651656715176528478f1a0eca0f2053fca469

  • SHA512

    ac029ea5a14cfc9adb816ace9959d85c91ec521e7d90af8d702c545b5962660221202305d4e656e23c2e1c115cd15d05991041d87bbb1f16ad4f2fecbf068a66

  • SSDEEP

    384:bA74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUgIunIVpeNs23mAA6luXIy:bA74zYcgT/Ekd0ryfjPIunqpeNswmNXJ

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-15_5dde0a380d252e4e51272f8754a983e1_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-15_5dde0a380d252e4e51272f8754a983e1_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1252
    • C:\Users\Admin\AppData\Local\Temp\hasfj.exe
      "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
      2⤵
      • Executes dropped EXE
      PID:1308

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\hasfj.exe

    Filesize

    37KB

    MD5

    d9cd407afa65af131dd71bf0bab20f5c

    SHA1

    85b8f502e2efb24e303530c9387d65f54cc3b115

    SHA256

    bbc0f1e2107bd1e15f111fe456cf5a7a4a53d53063f19859dc08545d5141a728

    SHA512

    a22249ac5c5a19d656bd66e301a48d95628e8e1841ff345821082db9293b4821ecdc170a5cf712b7dd8a79e7be7a72f53f77abd0ce493b2e89e3071685178e65

  • memory/1252-0-0x00000000020A0000-0x00000000020A6000-memory.dmp

    Filesize

    24KB

  • memory/1252-1-0x00000000020A0000-0x00000000020A6000-memory.dmp

    Filesize

    24KB

  • memory/1252-2-0x0000000003010000-0x0000000003016000-memory.dmp

    Filesize

    24KB

  • memory/1308-18-0x0000000002200000-0x0000000002206000-memory.dmp

    Filesize

    24KB

  • memory/1308-17-0x0000000002230000-0x0000000002236000-memory.dmp

    Filesize

    24KB