Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/05/2024, 02:28

General

  • Target

    2024-05-28_1f60b2a052332bf1590e6c4453d11a24_cryptolocker.exe

  • Size

    43KB

  • MD5

    1f60b2a052332bf1590e6c4453d11a24

  • SHA1

    c7c434ae175280cf1ba39f756882ad8db7f2b97a

  • SHA256

    d61e888cf0c380edbfc966624e96c9bdcb1620f072efc6159dd038f5ff7cc1a0

  • SHA512

    3a2bc14b9ee575878a360c10ba85da84acb051a01eef235f17989ee2a9ecb1a9355294d95bb6ccb50c66db76ef8dc46e8d5528a21fb6c5d79d8dafaf0843ace4

  • SSDEEP

    768:bCDOw9UiaKHfjnD0S16avdrQFiLjJvtAQ:bCDOw9aMDooc+vAQ

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-28_1f60b2a052332bf1590e6c4453d11a24_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-28_1f60b2a052332bf1590e6c4453d11a24_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:224
    • C:\Users\Admin\AppData\Local\Temp\lossy.exe
      "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
      2⤵
      • Executes dropped EXE
      PID:3468

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\lossy.exe

    Filesize

    43KB

    MD5

    b929b15e5709361d25d6fd49ec9a6dfc

    SHA1

    46cbcb9952e8e5db1c488197e081ec793b669de7

    SHA256

    51a61ac6e6cc5f3166a47d5d5e44d8fc744ed00f850488a0aa8c6090eed202e7

    SHA512

    c92a67d294d211532e3d4b014b4b3731856f710619b127b0f00f3594d77d195d13869848de12326737ca19c2c44276b0e6d5227b5f149a76847056d4eb5912ce

  • memory/224-0-0x0000000008000000-0x000000000800A000-memory.dmp

    Filesize

    40KB

  • memory/224-1-0x00000000005A0000-0x00000000005A6000-memory.dmp

    Filesize

    24KB

  • memory/224-2-0x00000000005C0000-0x00000000005C6000-memory.dmp

    Filesize

    24KB

  • memory/224-8-0x00000000005A0000-0x00000000005A6000-memory.dmp

    Filesize

    24KB

  • memory/224-17-0x0000000008000000-0x000000000800A000-memory.dmp

    Filesize

    40KB

  • memory/3468-18-0x0000000008000000-0x000000000800A000-memory.dmp

    Filesize

    40KB

  • memory/3468-20-0x0000000001FE0000-0x0000000001FE6000-memory.dmp

    Filesize

    24KB

  • memory/3468-26-0x00000000006A0000-0x00000000006A6000-memory.dmp

    Filesize

    24KB

  • memory/3468-27-0x0000000008000000-0x000000000800A000-memory.dmp

    Filesize

    40KB