Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/05/2024, 03:40

General

  • Target

    2024-05-04_c6ab5ceafe0f146e240774a5cee153cb_cryptolocker.exe

  • Size

    52KB

  • MD5

    c6ab5ceafe0f146e240774a5cee153cb

  • SHA1

    7a36fcc2c802303f8adc50eaa1e1cd8f1aea3e93

  • SHA256

    23fda4d3d26ed2d8222ac9007c042eba394c3c4a2240a74eea9c28bfecdb8869

  • SHA512

    60cd8c3ac609938e4d1ffff9d3866047fb647129017b50b2a86a2971799dc38e62ad9a9b4953e269cf6c14306b704728a8fa2b8452f6258197965663802636d5

  • SSDEEP

    768:bIDOw9UiaCHfjnE0Sfa7ilR0p9u6p4ICNBCXK9Xv+mb6uYGER:bIDOw9a0DwitDZzc161R

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-04_c6ab5ceafe0f146e240774a5cee153cb_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-04_c6ab5ceafe0f146e240774a5cee153cb_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3324
    • C:\Users\Admin\AppData\Local\Temp\lossy.exe
      "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
      2⤵
      • Executes dropped EXE
      PID:1888

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\lossy.exe

    Filesize

    52KB

    MD5

    39f7b1f0ecce1c9f45f7fcfe3cff521b

    SHA1

    4ef73148054905e81a136dabcbc28c3a9a1eab0f

    SHA256

    eb02b63713e6fca3333d53b8edeb44ec4fc9d9bdde0e39555d84a6bf7e2346fd

    SHA512

    88a524d0e733c0282b8d4dc07f67c3adf4681c846a7e2ae77524536b0015ccdac4ced230b0255628d184f9f3da15163035603a27728c3849a244999a62613be9

  • memory/1888-23-0x00000000006A0000-0x00000000006A6000-memory.dmp

    Filesize

    24KB

  • memory/1888-17-0x00000000006C0000-0x00000000006C6000-memory.dmp

    Filesize

    24KB

  • memory/3324-0-0x00000000021D0000-0x00000000021D6000-memory.dmp

    Filesize

    24KB

  • memory/3324-1-0x0000000002070000-0x0000000002076000-memory.dmp

    Filesize

    24KB

  • memory/3324-8-0x00000000021D0000-0x00000000021D6000-memory.dmp

    Filesize

    24KB