Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/03/2024, 10:54

General

  • Target

    2024-03-18_ed959e9f6095825f36369e7fa5e8528b_cryptolocker.exe

  • Size

    63KB

  • MD5

    ed959e9f6095825f36369e7fa5e8528b

  • SHA1

    fd7e4d285dede361fe3adc3d328b17cd91a657b4

  • SHA256

    6ab1440d889273a4706e9f0b238b0c2b227e38a3494454be07a4a39dd6a4b4a1

  • SHA512

    67160921695d62db7cd5b3af6d8a6c20658b23de105b619cb74b7290c30fc9a4ea2f489948e66cd9cf54702feaeaf7b72f40ea02e21fd77cc06efb00d452d6b4

  • SSDEEP

    1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszudnYTjipvF299eX:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7s

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-18_ed959e9f6095825f36369e7fa5e8528b_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-18_ed959e9f6095825f36369e7fa5e8528b_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3328
    • C:\Users\Admin\AppData\Local\Temp\hurok.exe
      "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      PID:3652

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\hurok.exe

    Filesize

    63KB

    MD5

    3d2619df2f35c090f71188b44d2848d5

    SHA1

    498afd7c6959be0b602d818964e1d958e50b30e6

    SHA256

    595186a9f280d55d694d43feb5e0158ed6e66f851cf10f3f5ab68dc81f683227

    SHA512

    3950a2de96656436da8ef62a4d5d230a8abf271a56fbd1daa1ca0a4073f790edb0e7890d9a44776d4f41f90ece2a4b489bdcf260c2f3db50302aa936ef2d1783

  • memory/3328-0-0x0000000000470000-0x0000000000476000-memory.dmp

    Filesize

    24KB

  • memory/3328-1-0x0000000000470000-0x0000000000476000-memory.dmp

    Filesize

    24KB

  • memory/3328-2-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/3652-24-0x00000000004C0000-0x00000000004C6000-memory.dmp

    Filesize

    24KB