Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    126s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/05/2024, 11:43

General

  • Target

    2024-05-15_1fabe94190a787efe535eedd889f69fe_cryptolocker.exe

  • Size

    34KB

  • MD5

    1fabe94190a787efe535eedd889f69fe

  • SHA1

    301807d3fa2bbb72ca1a3b6c4640e047bb7c61e5

  • SHA256

    6e4afaa07eede316422448b00d80461570a32c7bfb91b061d2971f858a11a972

  • SHA512

    e984083027696ce8f17ef9f90317783a2d8c9c51540329ac6e1b9d87cbb20809070e7f07aa29d8d31b0df2c9a3b27e85199278846c0e6761db0cd6bd1337bb47

  • SSDEEP

    768:bxNQIE0eBhkL2Fo1CCwgfjOg9Arbkzos5M4yQPv:bxNrC7kYo1Fxf2rYA7QX

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-15_1fabe94190a787efe535eedd889f69fe_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-15_1fabe94190a787efe535eedd889f69fe_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2372
    • C:\Users\Admin\AppData\Local\Temp\pissa.exe
      "C:\Users\Admin\AppData\Local\Temp\pissa.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      PID:4288
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3452,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:8
    1⤵
      PID:440

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\pissa.exe

      Filesize

      35KB

      MD5

      46b77d9e413b194390aa19b7ff222583

      SHA1

      ca5de428e736890c23b5b17a953091b83ac2ab7a

      SHA256

      81c762bec4e73cbd4f01dbc21f7c2b775d196a7a36c449f34384667215e2593c

      SHA512

      fda2a02948b6d7a591c00e7b5f0a5e5f2badfd27603fef8791f93c79ef81dffed58c5dcc8f577e804564c51fff174b7268208831f93398d4d3d4d1b9a9d13cec

    • C:\Users\Admin\AppData\Local\Temp\pissec.exe

      Filesize

      261B

      MD5

      11bed1c06d8f4680de5154405be20365

      SHA1

      9c3095f1aa0b02924c23592d1e86673bb0081ca1

      SHA256

      bcc0582f122db6e61d2aa06628275f5b882c01ca037699427d0f68e48d744666

      SHA512

      050bb38ff33ab7e8e8aa647cffb26d2b0a54074340e79f0acf0db8f076c421505f1e4c1ce169d55aeacd4085ce258a78d24327c9393650642963beb130517da8

    • memory/2372-0-0x0000000002200000-0x0000000002206000-memory.dmp

      Filesize

      24KB

    • memory/2372-1-0x0000000002200000-0x0000000002206000-memory.dmp

      Filesize

      24KB

    • memory/2372-2-0x0000000003150000-0x0000000003156000-memory.dmp

      Filesize

      24KB

    • memory/4288-23-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

      Filesize

      24KB