Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    136s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/05/2024, 05:23

General

  • Target

    2024-05-11_08926f99370fbaa312f72b3264600591_cryptolocker.exe

  • Size

    56KB

  • MD5

    08926f99370fbaa312f72b3264600591

  • SHA1

    80613d31506a76a68e008ef77ffeffe83c50c382

  • SHA256

    090f2fb3df61f906fc3592eb7b26a01fbbf1ce9d99d84fb7102c3c6d1dc846af

  • SHA512

    19b0a804c8a54858431baa8a0dbe5735976d818bff44e164cde2a7b5138169e7913f98e8f2a48235db74814eacf8d77eb5842b9a21c8adb267fe4da07704fafd

  • SSDEEP

    768:bP9g/WItCSsAfFaeOcfXVr3BPOz5CFBmNuFgUjlugJp:bP9g/xtCS3Dxx0ep

Score
9/10
upx

Malware Config

Signatures

  • Detection of CryptoLocker Variants 2 IoCs
  • UPX dump on OEP (original entry point) 2 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-11_08926f99370fbaa312f72b3264600591_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-11_08926f99370fbaa312f72b3264600591_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2300
    • C:\Users\Admin\AppData\Local\Temp\gewos.exe
      "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      PID:4212

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\gewos.exe

    Filesize

    56KB

    MD5

    50d22f32a22a41c462766b53547bd142

    SHA1

    b76a5829bf8d82a85f9f32042eee6e9002d9dab3

    SHA256

    2625baf6986568eee784203d4e29f407458aca7b062a39db46e39cfb6795529b

    SHA512

    df5f552597cc4297c7c980fc3ab5d3137980f8b8d3ceafe7c99da4cc6527608dd592d1d0d78f6714dc0c34fb8937002745bbc099af2e104440ece46c66989670

  • C:\Users\Admin\AppData\Local\Temp\gewosik.exe

    Filesize

    185B

    MD5

    34deb086cc238e6cf46761b36e8225cc

    SHA1

    2b2414700fc2b9665b686dc849b447f72b6cee6e

    SHA256

    22a66c63dd5b46bbcc7efe9761845119ccf0f5b3d9b2c063361db4e82f58a8ff

    SHA512

    375212fd93aa17b0148391b1274bfcada887e070396b7bcf2267fdf48db365409027c7c5c023f85cc002c1cd24571f690589e9c557b7f3586b13075b4dce4b7a

  • memory/2300-0-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/2300-1-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

    Filesize

    24KB

  • memory/2300-2-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/2300-9-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

    Filesize

    24KB

  • memory/4212-26-0x0000000002D60000-0x0000000002D66000-memory.dmp

    Filesize

    24KB