Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/04/2024, 20:46

General

  • Target

    2024-04-05_bf7cbbdafe86f694bc575de80e8d3b3a_cryptolocker.exe

  • Size

    54KB

  • MD5

    bf7cbbdafe86f694bc575de80e8d3b3a

  • SHA1

    c6aa29fece80c0e0615e07460de47bac10f9b611

  • SHA256

    0cce5199517f0107bd1528c62cc6d7b29fa846bb05ad3b980296d832614486b9

  • SHA512

    fd9ff9a73a597eaaf43109c1daaa03819bbe8ea675d34f67285ce78e24c20e013a267ef7ab0a4f9cd474804e74534385a669ee0bfcc383b89169eb42e87a7d83

  • SSDEEP

    1536:V6QFElP6n+gMQMOtEvwDpjeJQ7pojakl8eys:V6a+pOtEvwDpj8

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-05_bf7cbbdafe86f694bc575de80e8d3b3a_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-05_bf7cbbdafe86f694bc575de80e8d3b3a_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2124
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:1484

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    54KB

    MD5

    e026a5c320c8d724783bb7c13c89367a

    SHA1

    da0a71387d7e7eb0fca219264ca7ca4b1a781260

    SHA256

    fa8a9d03dd15186288212cdd472ecc4811d58a594050c97c5d464a2ad2f889ef

    SHA512

    6dd44b017a59391c3c43e257d5e9bbf0c365c620afa8aa913218a8d2a6492ef22e2697d74a5ce580087876cac4e9813202e7407cea652a72a7e727e1eccecec8

  • memory/1484-17-0x0000000002060000-0x0000000002066000-memory.dmp

    Filesize

    24KB

  • memory/1484-18-0x00000000006A0000-0x00000000006A6000-memory.dmp

    Filesize

    24KB

  • memory/2124-0-0x00000000004C0000-0x00000000004C6000-memory.dmp

    Filesize

    24KB

  • memory/2124-1-0x00000000004C0000-0x00000000004C6000-memory.dmp

    Filesize

    24KB

  • memory/2124-2-0x00000000004E0000-0x00000000004E6000-memory.dmp

    Filesize

    24KB