Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/04/2024, 13:46

General

  • Target

    2024-04-09_ae6f17bc76d44cf4eca4075e2314cc23_cryptolocker.exe

  • Size

    41KB

  • MD5

    ae6f17bc76d44cf4eca4075e2314cc23

  • SHA1

    eee05fda94b6bdd41b16d50f0728f54002c99838

  • SHA256

    0be56c7c320207280f5c9bfe7bf13e828c7a14b68121ae2258e2df22ea37b3cc

  • SHA512

    02144fad9eb4f24ac3c80037493808140baee9999bbe25439d09ccc9defb3b218964a0bdc07b8979ea631d2619c48ccb7cc725f0735f3c20fbcdd960b1cba9ca

  • SSDEEP

    768:b7o/2n1TCraU6GD1a4X0WcO+wMVm+slAMRYtsh:bc/y2lkF0+BlI

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-09_ae6f17bc76d44cf4eca4075e2314cc23_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-09_ae6f17bc76d44cf4eca4075e2314cc23_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4812
    • C:\Users\Admin\AppData\Local\Temp\rewok.exe
      "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
      2⤵
      • Executes dropped EXE
      PID:5008

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\rewok.exe

    Filesize

    42KB

    MD5

    73f7c59337d9e7341cf1e77e8c2efecf

    SHA1

    e9996fadb9273ef8b4db9b8a467334c0d1b3eda5

    SHA256

    5a750bb00fc4474bc3bbd06a6d71dbb5ccac2282e6422213e17764bb8a7c5cf8

    SHA512

    eeed03bc3340524152f4b80b107e7b52f3f7fdc602b044857920f94f9af2cd264f8573f422eb88839af948cf86e4d14a7c653b3f20737c5870bdf9bcb24bb024

  • memory/4812-0-0x0000000002210000-0x0000000002216000-memory.dmp

    Filesize

    24KB

  • memory/4812-1-0x0000000002210000-0x0000000002216000-memory.dmp

    Filesize

    24KB

  • memory/4812-2-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/5008-20-0x0000000000770000-0x0000000000776000-memory.dmp

    Filesize

    24KB