Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/03/2024, 16:36

General

  • Target

    2024-03-29_2fcfe5fc16bb7d0d246a506cdbc83cce_cryptolocker.exe

  • Size

    46KB

  • MD5

    2fcfe5fc16bb7d0d246a506cdbc83cce

  • SHA1

    6b5413586aeb8aaf9d9a72e7507072a854551f17

  • SHA256

    b474e4a2123c8ee0b269c3059ad6319e8f8fb6bbeefbf1ad120e90c16a5c6159

  • SHA512

    ccc44f95e37409db68820c1bef71fdf2ce981949bcd978ba133f850b6bb79344d003dff61619a5ed31b1af408e0211ef1f1ca9608aee14b4e2873ddd20c56f3a

  • SSDEEP

    768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6j4AYsqSh+DETkedmhXSj:YGzl5wjRQBBOsP1QMOtEvwDpjl39+D+l

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 4 IoCs
  • Detection of Cryptolocker Samples 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-29_2fcfe5fc16bb7d0d246a506cdbc83cce_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-29_2fcfe5fc16bb7d0d246a506cdbc83cce_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1996
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:3720

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    46KB

    MD5

    2359254efe317b8a619a2b533de9fce1

    SHA1

    ef85bb8da48ff8b800c43224c4ee24bc6850029a

    SHA256

    2d1128b891241dde42b8fd7691739875664b3ba41cd4b1c49f6e091b961aad9c

    SHA512

    2422a078881e6d78dbe01f1f926a01e26e1c4b350babeba08a651ae8d30cabcb11361cf5b37e0af1d8f424f8ca55f24674f57bc0a04d7da8301f1feddca4b862

  • memory/1996-0-0x0000000000500000-0x000000000050B000-memory.dmp

    Filesize

    44KB

  • memory/1996-1-0x00000000006F0000-0x00000000006F6000-memory.dmp

    Filesize

    24KB

  • memory/1996-2-0x00000000006F0000-0x00000000006F6000-memory.dmp

    Filesize

    24KB

  • memory/1996-3-0x0000000000710000-0x0000000000716000-memory.dmp

    Filesize

    24KB

  • memory/1996-17-0x0000000000500000-0x000000000050B000-memory.dmp

    Filesize

    44KB

  • memory/3720-18-0x0000000000500000-0x000000000050B000-memory.dmp

    Filesize

    44KB

  • memory/3720-20-0x00000000004F0000-0x00000000004F6000-memory.dmp

    Filesize

    24KB

  • memory/3720-26-0x00000000004D0000-0x00000000004D6000-memory.dmp

    Filesize

    24KB