Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    97s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/04/2024, 16:24

General

  • Target

    2024-04-08_36d3932a7e3a32d1cf64d4b2c0a21acf_cryptolocker.exe

  • Size

    44KB

  • MD5

    36d3932a7e3a32d1cf64d4b2c0a21acf

  • SHA1

    03733d4a58404f34e717c560a354005d3f74e527

  • SHA256

    610cd01e51e9ff15e4e4e8a9235c52ee3894afa9c26704282de596759329ae36

  • SHA512

    7c8e92fe574f50e330cfa1b86b604e119c885ca9021925672e288352629f3798375d8ad452588575bca744ff2af27a412d4873a84b0c1fc7b492a6d679d04377

  • SSDEEP

    768:btB9g/WItCSsAGjX7r3BPOMHoc/QQJ1RD4i:btB9g/xtCSKfxLIc/bRDh

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-08_36d3932a7e3a32d1cf64d4b2c0a21acf_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-08_36d3932a7e3a32d1cf64d4b2c0a21acf_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2648
    • C:\Users\Admin\AppData\Local\Temp\gewos.exe
      "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      PID:4708

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\gewos.exe

    Filesize

    45KB

    MD5

    9f2a82c7fba6a2fd1c6650d348e964c4

    SHA1

    6c34316057c08140da53d0eb8f0a4a7f49ec8555

    SHA256

    723edebf00788e247887248c34f4a2662a025c7160a97dc9991792a689825c65

    SHA512

    84ded1cbce323aea5464f669aba8aabb6b89d4ec1d146cbea7ad32582e92c8055ea9229821866be591fc646b24ac751e63ee6c6aacdc822e166f33d2601897f2

  • memory/2648-0-0x00000000022C0000-0x00000000022C6000-memory.dmp

    Filesize

    24KB

  • memory/2648-2-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/2648-1-0x00000000022C0000-0x00000000022C6000-memory.dmp

    Filesize

    24KB

  • memory/4708-20-0x0000000002210000-0x0000000002216000-memory.dmp

    Filesize

    24KB