Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    70s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/04/2024, 01:30

General

  • Target

    2024-04-24_9683b4427c01bf9676d7ec2b6d902960_cryptolocker.exe

  • Size

    41KB

  • MD5

    9683b4427c01bf9676d7ec2b6d902960

  • SHA1

    00c24050ed8fa8f13030e8f1a3b224a7dffee87c

  • SHA256

    de843f6c7adebe8ccd59acda7dd196b133172bc2e922014d918650cfb1a81f61

  • SHA512

    c29badb06f42dca2b19d420e0f735fe5eb80b221c3bb5f0fb2a15f12269576d0b453cd3d8f03f98f11a72ad45919bb263296cc741f0a6ae64437ad15f0b5758a

  • SSDEEP

    768:bCDOw9UiaKHfjnD0S16avdrQFiLjJvtA2:bCDOw9aMDooc+vA2

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-24_9683b4427c01bf9676d7ec2b6d902960_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-24_9683b4427c01bf9676d7ec2b6d902960_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4480
    • C:\Users\Admin\AppData\Local\Temp\lossy.exe
      "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
      2⤵
      • Executes dropped EXE
      PID:4544

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\lossy.exe

    Filesize

    41KB

    MD5

    4c8a92f86034d5a893674254d29a99fa

    SHA1

    6650437e1f2e162f0fabc4c7cc41d3a8938e52e1

    SHA256

    ff331aa05e4ae696381607d8f90cd11f1ff8d4a73b899916c291fa49e774a33d

    SHA512

    5a720c4e2ac52dfc135531e05204f55b17495ae9e1c2ffc4dbd2a1168d7102f123545d6852e9ea7e269fb446e98ceb3eb9e647fee4aaf85fe23be8d50b665b24

  • memory/4480-0-0x0000000008000000-0x000000000800A000-memory.dmp

    Filesize

    40KB

  • memory/4480-1-0x0000000000590000-0x0000000000596000-memory.dmp

    Filesize

    24KB

  • memory/4480-2-0x0000000000590000-0x0000000000596000-memory.dmp

    Filesize

    24KB

  • memory/4480-3-0x00000000006C0000-0x00000000006C6000-memory.dmp

    Filesize

    24KB

  • memory/4480-18-0x0000000008000000-0x000000000800A000-memory.dmp

    Filesize

    40KB

  • memory/4544-17-0x0000000008000000-0x000000000800A000-memory.dmp

    Filesize

    40KB

  • memory/4544-20-0x0000000002060000-0x0000000002066000-memory.dmp

    Filesize

    24KB

  • memory/4544-26-0x0000000002040000-0x0000000002046000-memory.dmp

    Filesize

    24KB

  • memory/4544-27-0x0000000008000000-0x000000000800A000-memory.dmp

    Filesize

    40KB