Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/05/2024, 05:24

General

  • Target

    2024-05-14_786b38e53d4972bf571cda145f6710c9_cryptolocker.exe

  • Size

    52KB

  • MD5

    786b38e53d4972bf571cda145f6710c9

  • SHA1

    f5e7589b6573692d199ce474b55fb55b1bea0cdf

  • SHA256

    6b80bf438c7628f41eae903784af8be108fd3b7adc36a2252245b5eff81b5ecf

  • SHA512

    b584b0c1f636918389c29cf955a476a9f6c72c7637375990830f4e6c5112daac1c6431521ef6ab7b63858199e28888e93c8ebfb5f908cc7db71060534c3d927a

  • SSDEEP

    768:z6LsoEEeegiZPvEhHSG+gzum/kLyMro2GtOOtEvwDpj/YY1J+OTOn1:z6QFElP6n+gKmddpMOtEvwDpj31i1

Score
9/10
upx

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • Detection of Cryptolocker Samples 5 IoCs
  • UPX dump on OEP (original entry point) 5 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-14_786b38e53d4972bf571cda145f6710c9_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-14_786b38e53d4972bf571cda145f6710c9_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3616
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:2888

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    52KB

    MD5

    ab5cf5c3031672b68b7a4e8ed2d79201

    SHA1

    a89733bbcad159afda796561c63a27a7b0b8e21c

    SHA256

    6b17aa0625fd3e2f8e1d60175ec095ea7cac9e17854eb33f0ab53aaaf2b5adaf

    SHA512

    ec80d403f5c72f86b1c6692e95ba11d36c1eae5a9ffbfaa7c0deffd3993d2593e0354fd6a81ee1a3456f2b6b73eff401ec11e160c30a410de9ebc34cfec793a8

  • memory/2888-17-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2888-20-0x0000000001F80000-0x0000000001F86000-memory.dmp

    Filesize

    24KB

  • memory/2888-26-0x0000000001F60000-0x0000000001F66000-memory.dmp

    Filesize

    24KB

  • memory/2888-27-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/3616-1-0x0000000000560000-0x0000000000566000-memory.dmp

    Filesize

    24KB

  • memory/3616-2-0x0000000000680000-0x0000000000686000-memory.dmp

    Filesize

    24KB

  • memory/3616-9-0x0000000000560000-0x0000000000566000-memory.dmp

    Filesize

    24KB

  • memory/3616-0-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/3616-18-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB