Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/04/2024, 20:30

General

  • Target

    2024-04-15_20d8054dfbf8a6e5d3835ec9778f97d6_cryptolocker.exe

  • Size

    41KB

  • MD5

    20d8054dfbf8a6e5d3835ec9778f97d6

  • SHA1

    641852cef77f7b5959ec64238627b2fe08c12aba

  • SHA256

    44ab2ce8d7000ba457b5c7f4f63c9f807d3c3a5ed4f3ed6b298aba606095cd7b

  • SHA512

    3d4594611a451c5a8fb7fe9af817e9ee07f7d45b62ed1319de2579f945e613e01949dfff72f56ec360e2585a401004dc4bc6f9b2980c3ad554f2ba4ed88590f9

  • SSDEEP

    768:TS5nQJ24LR7tOOtEvwDpjGqPhqlcnvhx5/xFRY+iy4:m5nkFNMOtEvwDpjG8hhXy+iy4

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 4 IoCs
  • Detection of Cryptolocker Samples 2 IoCs
  • Detects executables built or packed with MPress PE compressor 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-15_20d8054dfbf8a6e5d3835ec9778f97d6_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-15_20d8054dfbf8a6e5d3835ec9778f97d6_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4764
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Executes dropped EXE
      PID:2760
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4472 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:864

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\misid.exe

      Filesize

      41KB

      MD5

      12394b231f21b4aa7f0e4de73ca8cc5c

      SHA1

      9b40157c970cd54105a3b2d89a09456b891a6e2f

      SHA256

      d3c83e4bc07a3030dedb6f70ee79c6b485073013e66e2c533d6b2ff75512c269

      SHA512

      970da6e421868d516dd3c2a0afcdb66d3f75ae232bacf502d00c2f033864196cc27fd2348831bf239afebab7846d2230061c141d105fff3d377e83728ae792c2

    • memory/2760-20-0x0000000002140000-0x0000000002146000-memory.dmp

      Filesize

      24KB

    • memory/2760-18-0x0000000002060000-0x0000000002066000-memory.dmp

      Filesize

      24KB

    • memory/2760-26-0x0000000000500000-0x000000000050E000-memory.dmp

      Filesize

      56KB

    • memory/4764-0-0x0000000000500000-0x000000000050E000-memory.dmp

      Filesize

      56KB

    • memory/4764-1-0x00000000006F0000-0x00000000006F6000-memory.dmp

      Filesize

      24KB

    • memory/4764-2-0x00000000006F0000-0x00000000006F6000-memory.dmp

      Filesize

      24KB

    • memory/4764-3-0x00000000021C0000-0x00000000021C6000-memory.dmp

      Filesize

      24KB

    • memory/4764-19-0x0000000000500000-0x000000000050E000-memory.dmp

      Filesize

      56KB