Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/04/2024, 03:39

General

  • Target

    2024-04-17_4bb5eec13b3cc707961f391b3af60be9_cryptolocker.exe

  • Size

    388KB

  • MD5

    4bb5eec13b3cc707961f391b3af60be9

  • SHA1

    d25785479cee9da95cc0d65ccbbcf262651dbe58

  • SHA256

    b23f8f4ce6712274e8b6200a35b112d02a867c0819a94ee3feaa736475f6fc11

  • SHA512

    28142373e2aa466432bc1c6365e9ece1bbfb0b157d2957dd3678737b01da74ad61d38503d8afaa3a468ed666e586e03e3998143ebfdf0161afb211163ec5e8e6

  • SSDEEP

    6144:nnOsaQgAOjvrZFODJjBz3j1jTqQy6v2GGnugOtihzXU:nnOflT/ZFIjBz3xjTxynGUOUhXU

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-17_4bb5eec13b3cc707961f391b3af60be9_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-17_4bb5eec13b3cc707961f391b3af60be9_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3436
    • C:\Users\Admin\AppData\Local\Temp\hasfj.exe
      "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
      2⤵
      • Executes dropped EXE
      PID:4472

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\hasfj.exe

    Filesize

    388KB

    MD5

    2ff3b67b8918244f60d2968b2965285d

    SHA1

    2d00e0941e35b97a7772da13f96b5ef1448f61aa

    SHA256

    b75420043e48843464e4052e0990a0fdc34fb7b89f174db2288d3f3a460d95bd

    SHA512

    c708a14e54204a14060819a14427040e9fb447a790d061f10de62922e96d50ea3527b81848eb9fbdd9ee3f0db29d93264dcebf38ab7f0fbe1c48d902a06aed45

  • memory/3436-0-0x0000000002210000-0x0000000002216000-memory.dmp

    Filesize

    24KB

  • memory/3436-1-0x0000000002210000-0x0000000002216000-memory.dmp

    Filesize

    24KB

  • memory/3436-2-0x0000000003010000-0x0000000003016000-memory.dmp

    Filesize

    24KB

  • memory/4472-17-0x00000000020D0000-0x00000000020D6000-memory.dmp

    Filesize

    24KB

  • memory/4472-19-0x0000000000780000-0x0000000000786000-memory.dmp

    Filesize

    24KB