Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/04/2024, 07:56

General

  • Target

    2024-04-11_efada5c6e1d8103d7a98ff6fda39bfa6_cryptolocker.exe

  • Size

    36KB

  • MD5

    efada5c6e1d8103d7a98ff6fda39bfa6

  • SHA1

    a5c760d4739bd3c8168828c536c746c88d6e8f83

  • SHA256

    fbc74f3416e98e68b138547ce502a206450232b0febd895a2bf592675d9d2e39

  • SHA512

    f70bfcc730cad377a2b51b7019c2559f936db9e2a1e01cc7d6035a7d1ba4427dba327ac499ca9352c935a3c59562b7bfd1a7a9dc3919d5af3814c7c5611c9880

  • SSDEEP

    384:bA74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUgIunIVpeNs23mAA6lmRgy:bA74zYcgT/Ekd0ryfjPIunqpeNswm9my

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-11_efada5c6e1d8103d7a98ff6fda39bfa6_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-11_efada5c6e1d8103d7a98ff6fda39bfa6_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1332
    • C:\Users\Admin\AppData\Local\Temp\hasfj.exe
      "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
      2⤵
      • Executes dropped EXE
      PID:2880

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\hasfj.exe

    Filesize

    37KB

    MD5

    b37971c624139fc8d882de0ab9b625c3

    SHA1

    69fdcc2156cd322de7f774acc9d30d5c6e6da467

    SHA256

    b85a969a52c691696f74aab1caa9592fb1d8b2c6bb26479cd8aaade6c2f29f05

    SHA512

    09f47bb42f907e12700701db06b9e5cc97e5168b357ef795e48d06480ddab915eae8b885f5b31d104bfed83e4bf9bc4c1e657f0a6acebc6f782670a493e44610

  • memory/1332-0-0x0000000002350000-0x0000000002356000-memory.dmp

    Filesize

    24KB

  • memory/1332-1-0x0000000002350000-0x0000000002356000-memory.dmp

    Filesize

    24KB

  • memory/1332-2-0x00000000023C0000-0x00000000023C6000-memory.dmp

    Filesize

    24KB

  • memory/2880-17-0x0000000003150000-0x0000000003156000-memory.dmp

    Filesize

    24KB

  • memory/2880-23-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

    Filesize

    24KB