Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    131s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/05/2024, 04:46

General

  • Target

    2024-05-24_db27bf1a2f547ee321e5f977c10f5d69_cryptolocker.exe

  • Size

    37KB

  • MD5

    db27bf1a2f547ee321e5f977c10f5d69

  • SHA1

    60d725b9730627a87199ced3714d35762a02fd93

  • SHA256

    5c6c1545f801fe1e5e74f2bf1b342e09cdae6d28acd9cbd29798116ce98533f5

  • SHA512

    62198c44c84133182273bc5d0cb655c09b47c5651cda9b1d1ff59c43cacc0ed01b8bf4c95014d02d698fed9570a32a69de17c490d1c0ea713c15417ee86548c6

  • SSDEEP

    768:fTz7y3lhsT+hs1SQtOOtEvwDpjfAu9+4G:fT+hsMQMOtEvwDpjoIHG

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-24_db27bf1a2f547ee321e5f977c10f5d69_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-24_db27bf1a2f547ee321e5f977c10f5d69_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:968
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies system certificate store
      PID:1820

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    37KB

    MD5

    4cf95abd66fc80736feec46f8a747f07

    SHA1

    8c5eb172460b505fea7a7563242c668381f70a45

    SHA256

    889e2a8349d4b14761527473d008c4e372140c2cab2b7d99390ef14901cba9af

    SHA512

    312306ba3cc465986153de5d0bfb2c0f92d924b74da54bc966ecb23b67b946fec4be3d2f60fa0837e6dd38de668eaac83898a3a1bb3d7b57f9530d68d6986bd7

  • C:\Users\Admin\AppData\Local\Temp\misids.exe

    Filesize

    315B

    MD5

    a34ac19f4afae63adc5d2f7bc970c07f

    SHA1

    a82190fc530c265aa40a045c21770d967f4767b8

    SHA256

    d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

    SHA512

    42e53d96e5961e95b7a984d9c9778a1d3bd8ee0c87b8b3b515fa31f67c2d073c8565afc2f4b962c43668c4efa1e478da9bb0ecffa79479c7e880731bc4c55765

  • memory/968-0-0x0000000002140000-0x0000000002146000-memory.dmp

    Filesize

    24KB

  • memory/968-1-0x0000000002050000-0x0000000002056000-memory.dmp

    Filesize

    24KB

  • memory/968-8-0x0000000002140000-0x0000000002146000-memory.dmp

    Filesize

    24KB

  • memory/1820-17-0x0000000002110000-0x0000000002116000-memory.dmp

    Filesize

    24KB

  • memory/1820-23-0x0000000001F50000-0x0000000001F56000-memory.dmp

    Filesize

    24KB