Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/04/2024, 15:02

General

  • Target

    2024-04-16_e4b09c0548b9d530b18a5b78d08d6461_cryptolocker.exe

  • Size

    66KB

  • MD5

    e4b09c0548b9d530b18a5b78d08d6461

  • SHA1

    52e29a1955b0ad61a3191c9de4dc2b7eb395e93f

  • SHA256

    32c96bdad6ea30e0097377991cf8bc037538549cf8da24f42c269f681ead8408

  • SHA512

    441a5cc00a1174e03c975a31823faf0a4cb2e658b79e7ed7b68664c8b354247feedd06aac3c31f7abb1f1ffcd68d2b5e4ad08f6da004ce84fd42fb503fb86c16

  • SSDEEP

    1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszudnYTjipvF293vaRLN:aq7tdgI2MyzNORQtOflIwoHNV2XBFV70

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-16_e4b09c0548b9d530b18a5b78d08d6461_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-16_e4b09c0548b9d530b18a5b78d08d6461_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1032
    • C:\Users\Admin\AppData\Local\Temp\hurok.exe
      "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      PID:2708

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\hurok.exe

    Filesize

    67KB

    MD5

    5d77bc26e2154d45c1709158f3ff95fa

    SHA1

    efadf2a0e7c0be58bc872b1c3b92eccc842ab351

    SHA256

    c0c87af564ccfa7ab9c9132f665e0a5849a33d137bee07edcb89c4310f9e2add

    SHA512

    a8b2a6f6fac9c21fb91aa291d63244b58ea33be529db0bcad1f7ab9f5c3e0bfe55468a251e31ae6c59e5cb275af1306c96ea2bedacb9fc00f22e96fe420b6ada

  • memory/1032-0-0x00000000006E0000-0x00000000006E6000-memory.dmp

    Filesize

    24KB

  • memory/1032-1-0x00000000006E0000-0x00000000006E6000-memory.dmp

    Filesize

    24KB

  • memory/1032-2-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/2708-25-0x0000000000590000-0x0000000000596000-memory.dmp

    Filesize

    24KB