Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/05/2024, 03:49

General

  • Target

    2024-05-12_45a4003e30ec7bb87055b82bd8dabd8f_cryptolocker.exe

  • Size

    41KB

  • MD5

    45a4003e30ec7bb87055b82bd8dabd8f

  • SHA1

    6196948e40bbc192f1893aebac9640aa969316d2

  • SHA256

    f4d3a6f6eb5118976870cf302a0c1cd9c6fb446faa66815a85b962d7c13effa9

  • SHA512

    ab9e0c5895078c85541b9612e4a575aecfbf5a935b5a7f015fa36fea9f9deac57189f11b7595e37fe378263d56c4d9fab556b135eee9892988a712a8b7a6cdc3

  • SSDEEP

    768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBaac4HK/wSvuQTCW:X6QFElP6n+gJQMOtEvwDpjBsYK/fp

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-12_45a4003e30ec7bb87055b82bd8dabd8f_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-12_45a4003e30ec7bb87055b82bd8dabd8f_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1320
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:4036

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    41KB

    MD5

    7a3d83f0c162e77c52d5e706fef06e1f

    SHA1

    a60c239dc5f51ddfad12a392aa61b7bb630a3463

    SHA256

    a3912a2450e99da80c0b21e758cf9de8710fc926905136deec3425454ed4ad5d

    SHA512

    479f7fe787d01c727a745750cf4d2043f8c80fe68bb231990669351f842da69642b5faf600c1f50934c154f3df453bc60248fc4325ce4037f4112dfbaf467451

  • memory/1320-0-0x00000000004D0000-0x00000000004D6000-memory.dmp

    Filesize

    24KB

  • memory/1320-1-0x00000000004F0000-0x00000000004F6000-memory.dmp

    Filesize

    24KB

  • memory/1320-8-0x00000000004D0000-0x00000000004D6000-memory.dmp

    Filesize

    24KB

  • memory/4036-17-0x00000000006F0000-0x00000000006F6000-memory.dmp

    Filesize

    24KB

  • memory/4036-23-0x00000000006C0000-0x00000000006C6000-memory.dmp

    Filesize

    24KB