Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/03/2024, 02:53

General

  • Target

    2024-03-29_5659cb1d8d263a7bcabc9b5a2cc33067_cryptolocker.exe

  • Size

    45KB

  • MD5

    5659cb1d8d263a7bcabc9b5a2cc33067

  • SHA1

    196ef36d163d2db36e2051124fc0e6a96ff53e91

  • SHA256

    823397b7d4dc5f1d3c7a083b681251b66fe45c17b656e8e109b69c40ed894985

  • SHA512

    3166a44a2a5ddcb93c33d34d36b182a614dc28d5edb744f6499067f7dd12f77e0fc757214f0dfc27f4f4639fdbc1d78d55e0ba38bb8566a9a6a71d1a9dc00468

  • SSDEEP

    768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6j4AYsqSh+DETkedmhXSJJL:YGzl5wjRQBBOsP1QMOtEvwDpjl39+D+9

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 3 IoCs
  • Detection of Cryptolocker Samples 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-29_5659cb1d8d263a7bcabc9b5a2cc33067_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-29_5659cb1d8d263a7bcabc9b5a2cc33067_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2152
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:2940

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    45KB

    MD5

    e37a566b226a9fd1578b12df8298fc9d

    SHA1

    72afef673bc1de39663ced7bd9e2b5478ade929e

    SHA256

    068526c9b1b992dc606105b0b44a48919391b1d66a8bd585a436257fa14037e2

    SHA512

    5710670c9ec86d9956c469ee8f74fa761824c3fa2c550a18305cf0f079cf3fe7226a7168a4825b88f93a01adcbbd063d61743a0239bd0991b90bca47d3bcb1d4

  • memory/2152-0-0x0000000000500000-0x000000000050B000-memory.dmp

    Filesize

    44KB

  • memory/2152-1-0x0000000000640000-0x0000000000646000-memory.dmp

    Filesize

    24KB

  • memory/2152-2-0x0000000000640000-0x0000000000646000-memory.dmp

    Filesize

    24KB

  • memory/2152-3-0x0000000000660000-0x0000000000666000-memory.dmp

    Filesize

    24KB

  • memory/2152-17-0x0000000000500000-0x000000000050B000-memory.dmp

    Filesize

    44KB

  • memory/2940-19-0x0000000002100000-0x0000000002106000-memory.dmp

    Filesize

    24KB

  • memory/2940-22-0x00000000020D0000-0x00000000020D6000-memory.dmp

    Filesize

    24KB