Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/03/2024, 03:49

General

  • Target

    2024-03-29_85a6705e18b0a586e97de3504157976f_cryptolocker.exe

  • Size

    98KB

  • MD5

    85a6705e18b0a586e97de3504157976f

  • SHA1

    0c64f1933da23e6b48527ef18b1c86a440c1deee

  • SHA256

    a14cf55e41b66b3e02f9665b268019f0776e2c7b9846e451b8d89a385e251e93

  • SHA512

    f1477014c00b1c0afe36413efedf176f9fcf7436fa3ee58f5a6053f419820709a2a784b613991decf96f8133e0d2039b1fce1044b3afdc4fe813bd47072a83ba

  • SSDEEP

    1536:26QFElP6n+gBQMOtEvwDpjQGYQbN/PKwNCWwO:26a+2OtEvwDpjtzx

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-29_85a6705e18b0a586e97de3504157976f_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-29_85a6705e18b0a586e97de3504157976f_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1636
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:4896

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    98KB

    MD5

    c62599a0205f5024267b5ed1d9d013e6

    SHA1

    aa041a47c34f742d0090408a6bee2eaa25601262

    SHA256

    7eded5215399e4373ce60fdfe1d1d74d3e4edc945bce3d1bcce7000f4ce74ec7

    SHA512

    5e2612e3241fe9ec35815a9e035bf82d278d10f6d8774407c5ff7d9fc33c56e24ea6f8e577e282256203454c32b22030a9bc2fd405225fb24f9a2699861bb73c

  • memory/1636-0-0x00000000006B0000-0x00000000006B6000-memory.dmp

    Filesize

    24KB

  • memory/1636-1-0x00000000006B0000-0x00000000006B6000-memory.dmp

    Filesize

    24KB

  • memory/1636-2-0x0000000000760000-0x0000000000766000-memory.dmp

    Filesize

    24KB

  • memory/4896-17-0x00000000006D0000-0x00000000006D6000-memory.dmp

    Filesize

    24KB