Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/05/2024, 07:30

General

  • Target

    2024-05-10_389f831ea5b4b59918688e6a8e5da593_cryptolocker.exe

  • Size

    32KB

  • MD5

    389f831ea5b4b59918688e6a8e5da593

  • SHA1

    12c8ba297e458620245f4428414b91831f5334cd

  • SHA256

    3b1409a1e7bbb1c24a5dde8e62d6b08741f07a7c4e7ee1ea892aed9c823894b1

  • SHA512

    dd6c7dd923f6e8c4f52b289ce39cd493c0e15b6926d46607db1e4e669cc576af45213541387a965032a2de1cf931339de160404abe84d61ab0103243c1bf3bdc

  • SSDEEP

    384:bG74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUGTGJO:bG74zYcgT/Ekd0ryfjF

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-10_389f831ea5b4b59918688e6a8e5da593_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-10_389f831ea5b4b59918688e6a8e5da593_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2724
    • C:\Users\Admin\AppData\Local\Temp\hasfj.exe
      "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
      2⤵
      • Executes dropped EXE
      PID:972

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\hasfj.exe

    Filesize

    32KB

    MD5

    5ac067e738a555cc199646824e2c7953

    SHA1

    fc16dbae0dd9c7a6d7fb24dade51286de7e77ad5

    SHA256

    51c6b90286089a8c2484f6392a791cfb170327888f14fd38032b9f0a3e6f81fd

    SHA512

    17dc30958447e2d96738a49f72e369a6559097bd7a2c08c751d5995ff09695d556fe25e1a6a8c612d7fc9d8959ee03bbca60ce10cca6b9353d95d16cbe007140

  • memory/972-18-0x0000000008000000-0x000000000800A000-memory.dmp

    Filesize

    40KB

  • memory/972-20-0x0000000003010000-0x0000000003016000-memory.dmp

    Filesize

    24KB

  • memory/972-26-0x0000000002250000-0x0000000002256000-memory.dmp

    Filesize

    24KB

  • memory/972-27-0x0000000008000000-0x000000000800A000-memory.dmp

    Filesize

    40KB

  • memory/2724-0-0x0000000008000000-0x000000000800A000-memory.dmp

    Filesize

    40KB

  • memory/2724-1-0x0000000002180000-0x0000000002186000-memory.dmp

    Filesize

    24KB

  • memory/2724-3-0x0000000002200000-0x0000000002206000-memory.dmp

    Filesize

    24KB

  • memory/2724-2-0x0000000002180000-0x0000000002186000-memory.dmp

    Filesize

    24KB

  • memory/2724-17-0x0000000008000000-0x000000000800A000-memory.dmp

    Filesize

    40KB