Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/04/2024, 04:46

General

  • Target

    2024-04-28_b3d23378754a9e941c348ef8e9ff2f9d_cryptolocker.exe

  • Size

    67KB

  • MD5

    b3d23378754a9e941c348ef8e9ff2f9d

  • SHA1

    6db89799c2e2f862d09a7984e1886d8e72e6b6c8

  • SHA256

    3a1c55a176ab9c45b62da0aa6aefe6c234e4811e4db6a2c83240564b947a531e

  • SHA512

    1a5403de83ed3ebb3fe397e93213d6e4daf7719af7ea6fa018e9d927418d670a3da9f25f821003c512897584c06e771d7577c260b0a9c16da530b4f0242bd3c7

  • SSDEEP

    1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszudnYTjipvF293vaRLB:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7g

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-28_b3d23378754a9e941c348ef8e9ff2f9d_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-28_b3d23378754a9e941c348ef8e9ff2f9d_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4812
    • C:\Users\Admin\AppData\Local\Temp\hurok.exe
      "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
      2⤵
      • Executes dropped EXE
      PID:4824

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\hurok.exe

    Filesize

    68KB

    MD5

    79b93caa75f8042b74e10e12700efe0c

    SHA1

    2648bee1d5246bf755db7f9eb87cfdf26b0402e8

    SHA256

    e52a8f879305366895d1acf6a86ad5f3c1491abf0cde5e02b49350ac5d86952e

    SHA512

    cae534969553b2935c9ef01acf1c2acb6da94d9b67c14a450b8b979331ab951633b5dc2d86dfacb5ae06a0e92361fd3328c89e589fce9c0a94e3c54bdbde3069

  • memory/4812-0-0x00000000021C0000-0x00000000021C6000-memory.dmp

    Filesize

    24KB

  • memory/4812-1-0x00000000021C0000-0x00000000021C6000-memory.dmp

    Filesize

    24KB

  • memory/4812-2-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/4824-25-0x00000000005A0000-0x00000000005A6000-memory.dmp

    Filesize

    24KB