Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/05/2024, 02:26

General

  • Target

    2024-05-02_39c684f4f09f512f4fa3efb9e223238b_cryptolocker.exe

  • Size

    44KB

  • MD5

    39c684f4f09f512f4fa3efb9e223238b

  • SHA1

    dd5d30076022acff1ce1ecc0771b49ad7ca470dc

  • SHA256

    743b95391604ece4eb58acbce54432d159272149457493e53e351cedeadc358d

  • SHA512

    60c9f75c19c6b269e0d35d686e3a4f5832aa1d99eb7bbdccdc167a2397daac3bed0fa8e55ce15523f0d0ec2f98bff06ece5eac5e0716c563d0f88cf1e267198b

  • SSDEEP

    768:Kf1K2exg2kBwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZsBGGpebVIYLHA3KxK:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XX

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-02_39c684f4f09f512f4fa3efb9e223238b_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-02_39c684f4f09f512f4fa3efb9e223238b_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1984
    • C:\Users\Admin\AppData\Local\Temp\hurok.exe
      "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      PID:1776

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\hurok.exe

    Filesize

    44KB

    MD5

    b0bd50430677b1df48ea927ddd617f92

    SHA1

    aaf598715067357cd130353804cd4e8f999c3a9c

    SHA256

    75a6f4717a682d4bc9ad07d28f862b03043b896eff23b25a382ac14c66b9ef56

    SHA512

    a17429ccc7993e74d6b4a3454f8bc9eb5b065ec8409a8bb048a07c944a742c532d3c24f8e8990f1ef47778b425abf955077c492ea5781b34b45b1480f43a069e

  • memory/1776-25-0x0000000002130000-0x0000000002136000-memory.dmp

    Filesize

    24KB

  • memory/1984-0-0x00000000005A0000-0x00000000005A6000-memory.dmp

    Filesize

    24KB

  • memory/1984-1-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/1984-8-0x00000000005A0000-0x00000000005A6000-memory.dmp

    Filesize

    24KB