Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/04/2024, 10:26

General

  • Target

    2024-04-18_0e37139c18ce6fc2cb88aec20a340be9_cryptolocker.exe

  • Size

    61KB

  • MD5

    0e37139c18ce6fc2cb88aec20a340be9

  • SHA1

    71c64949bd04f74438125812b6028ca0e6e6894f

  • SHA256

    e6f2ff6e896cd6e0a09df3c01db810f1cfb139cc4d9e87b303b7761017e50b89

  • SHA512

    db45e65cd187194fae0c65041422a9c23ca4a70ebb60e721d5cbe0bbf9335365d4737ee25e4ee13b5041da4ce6d3a7ddbd7678dcaaa39955e357539507410fbf

  • SSDEEP

    1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMNuSP:TCjsIOtEvwDpj5HE/OUHnSMZw

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • Detection of Cryptolocker Samples 5 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-18_0e37139c18ce6fc2cb88aec20a340be9_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-18_0e37139c18ce6fc2cb88aec20a340be9_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2520
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Executes dropped EXE
      PID:648

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    61KB

    MD5

    f89f0e72a76e165adaa3730103d61297

    SHA1

    e19300a022b2b88ad145e74d7617d4ab1635738c

    SHA256

    f5fe19aad48d0feb88cc6c81a38df610d48cd93eac5f89bbdbe2599aadc3928c

    SHA512

    a6749dd85fc3c1a7b464c2e9ceb263013cfee72916924e7863dc2460a4397e049360fec18d66f6d651834efd500b2c78438fcf7ea5a9907e955a8fd3c6729547

  • memory/648-17-0x0000000000500000-0x000000000050E000-memory.dmp

    Filesize

    56KB

  • memory/648-20-0x00000000006A0000-0x00000000006A6000-memory.dmp

    Filesize

    24KB

  • memory/648-21-0x0000000001FF0000-0x0000000001FF6000-memory.dmp

    Filesize

    24KB

  • memory/648-27-0x0000000000500000-0x000000000050E000-memory.dmp

    Filesize

    56KB

  • memory/2520-0-0x0000000000500000-0x000000000050E000-memory.dmp

    Filesize

    56KB

  • memory/2520-1-0x00000000021D0000-0x00000000021D6000-memory.dmp

    Filesize

    24KB

  • memory/2520-2-0x00000000021D0000-0x00000000021D6000-memory.dmp

    Filesize

    24KB

  • memory/2520-3-0x0000000002050000-0x0000000002056000-memory.dmp

    Filesize

    24KB

  • memory/2520-18-0x0000000000500000-0x000000000050E000-memory.dmp

    Filesize

    56KB