Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/04/2024, 12:33

General

  • Target

    2024-04-30_30a8b65216b63728f9e97b1a33ecd63d_cryptolocker.exe

  • Size

    43KB

  • MD5

    30a8b65216b63728f9e97b1a33ecd63d

  • SHA1

    b360b1997ec174eac75cc67b00ebe5461c6f3132

  • SHA256

    8386743c8c51fe2aaff0c11bd0b47ee54a42f0e4510e2853f43547f798602077

  • SHA512

    d786b47c6494cee72829af4256541efed6e110d464ef105b84a80529beb48e88a2e9a3bb8afe95edb2ea92174e87c7e4242372654b9023d3f739532b5a49161f

  • SSDEEP

    768:b7o/2n1TCraU6GD1a4X0WcO+wMVm+slAMphqp:bc/y2lkF0+Beqp

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-30_30a8b65216b63728f9e97b1a33ecd63d_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-30_30a8b65216b63728f9e97b1a33ecd63d_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4396
    • C:\Users\Admin\AppData\Local\Temp\rewok.exe
      "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
      2⤵
      • Executes dropped EXE
      PID:1504

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\rewok.exe

    Filesize

    43KB

    MD5

    93db196f0a1ef1c6f60a3942ebaa6a33

    SHA1

    ae0d9b9a720ca7229461f79e08d6bea638218635

    SHA256

    b677485e6c3050f42d815ea23ff89335356c0ec0f0b227084891b8e5b6843200

    SHA512

    5316f6f71e368f73b44ea9fc5133159bcd33383a008b9187c6646345515dfdccb5348d2600098621e30643e4855eb3e10a1f1f0365cb8333bc587387bb2db82b

  • memory/1504-25-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

    Filesize

    24KB

  • memory/4396-0-0x00000000020A0000-0x00000000020A6000-memory.dmp

    Filesize

    24KB

  • memory/4396-2-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/4396-8-0x00000000020A0000-0x00000000020A6000-memory.dmp

    Filesize

    24KB