Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/05/2024, 19:20

General

  • Target

    2024-05-30_b3295a7ff05ecb42e7822af0cc461775_cryptolocker.exe

  • Size

    54KB

  • MD5

    b3295a7ff05ecb42e7822af0cc461775

  • SHA1

    f14c8b9cf6e12a991839156838aa34bccbdf852a

  • SHA256

    42e06888b9a60fd41bd72296d8d1bb0f8030a79d2b29fd749536ca846700a428

  • SHA512

    ccbcf0b758e0a3c845440f446c76d02221690ec3bedc7a379391aa1ea9def9d623d3b607c598b3934a95f38df78647b4fa8d37906dd3e2ba30b487b24173bf87

  • SSDEEP

    768:bIDOw9UiaCHfjnE0Sfa7ilR0p9u6p4ICNBCXK9Xv+mb6uYGExYSa:bIDOw9a0DwitDZzc161Ba

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-30_b3295a7ff05ecb42e7822af0cc461775_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-30_b3295a7ff05ecb42e7822af0cc461775_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1484
    • C:\Users\Admin\AppData\Local\Temp\lossy.exe
      "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
      2⤵
      • Executes dropped EXE
      PID:1628

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\lossy.exe

    Filesize

    54KB

    MD5

    41be067d89e54f63b74e69261ea9916c

    SHA1

    e0d8417ed923bd061758c2cc839f5ece9e436f77

    SHA256

    ed7bc0711ca7e2601bb01841a2ccc6ee8d78130301848d2076541e94b753db54

    SHA512

    e4c8a08c55ff117c78735c3b435727c1177384390d89e759fa63a49fbc4cba6206731d5d046109a4c3420d4675990ba830cbd598205ca57dba52fcea559db7a9

  • memory/1484-0-0x0000000000590000-0x0000000000596000-memory.dmp

    Filesize

    24KB

  • memory/1484-1-0x00000000005B0000-0x00000000005B6000-memory.dmp

    Filesize

    24KB

  • memory/1484-8-0x0000000000590000-0x0000000000596000-memory.dmp

    Filesize

    24KB

  • memory/1628-17-0x00000000020F0000-0x00000000020F6000-memory.dmp

    Filesize

    24KB

  • memory/1628-23-0x0000000000490000-0x0000000000496000-memory.dmp

    Filesize

    24KB