Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/05/2024, 15:29

General

  • Target

    2024-05-03_986857b6e5dd207bdae00aa89bc35c9c_cryptolocker.exe

  • Size

    37KB

  • MD5

    986857b6e5dd207bdae00aa89bc35c9c

  • SHA1

    5abc792fa112537b55a94748df0b5774da8e05f7

  • SHA256

    44c333534980e561f853b50225f51d4ba3faa6bd90f424f38986b52d4657cdd8

  • SHA512

    6a2bdfb4ac75a3ab9a27a2c3398d2b63f84f2e59b3ef9bc8a9e47496b39228925ea6bb8415f918e363ecc4f10a3b48170418d9b228e49bc69ac19fe7537acb2a

  • SSDEEP

    768:b7o/2n1TCraU6GD1a4Xt9bRU6zA6o36mI1k:bc/y2lLRU6zA6qp

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-03_986857b6e5dd207bdae00aa89bc35c9c_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-03_986857b6e5dd207bdae00aa89bc35c9c_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3588
    • C:\Users\Admin\AppData\Local\Temp\rewok.exe
      "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
      2⤵
      • Executes dropped EXE
      PID:3276

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\rewok.exe

    Filesize

    37KB

    MD5

    2810f85a734549e387a0412f0257d8f7

    SHA1

    68c8bc6ca603fd0738a3173dde90acccff204102

    SHA256

    a48b3559abe53a7548c40be796f2405cb12dad1b955fcfdd2d1a04bb3089848a

    SHA512

    3cf3178307c394eb7127095e18825c8721645ae07f5d0caf1b9bfc3cacc1ad5cc10e2429586b6edef9d378d6a1928bbe2a71b9c83d1931780058a9143a4bf99e

  • memory/3276-25-0x0000000002250000-0x0000000002256000-memory.dmp

    Filesize

    24KB

  • memory/3588-0-0x0000000002060000-0x0000000002066000-memory.dmp

    Filesize

    24KB

  • memory/3588-1-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/3588-8-0x0000000002060000-0x0000000002066000-memory.dmp

    Filesize

    24KB