Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/05/2024, 17:04

General

  • Target

    2024-05-31_03d29f2b5b747296ed57d7ccea57495f_cryptolocker.exe

  • Size

    38KB

  • MD5

    03d29f2b5b747296ed57d7ccea57495f

  • SHA1

    e44a23b9995e2a675e47c58dc21857c8def04761

  • SHA256

    60f5244787828a82c59b0dec628971c311546d5354a2a0bbc25077961e9042a1

  • SHA512

    43860640b82efb4a43323f16e9352f4b9091521dc50bdca2fdd8cd0dca5364e7f0fbf9ec15cac09149ea4f3d99329e54cc28d82b8414a02b6b85b82d39d0ed0b

  • SSDEEP

    768:fTz7y3lhsT+hs1SQtOOtEvwDpjfAu9+4Hz:fT+hsMQMOtEvwDpjoIHT

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-31_03d29f2b5b747296ed57d7ccea57495f_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-31_03d29f2b5b747296ed57d7ccea57495f_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4976
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies system certificate store
      PID:2032

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    39KB

    MD5

    3efce5e66ee18dc5ddc3e1c899eed3b8

    SHA1

    8be992389c8c8346c0065937bf775bf5ee3e0d48

    SHA256

    1ba40045d0caba55a952c7f51f964d3b89923c6c83abd08d25a9772857a39c52

    SHA512

    b00b1012b31b2934839d8995e0f6ba8cd586fbb66553f6f371a0166cd63583e488104110832136f02695ca4e3d66daeabedbd77bf8e49064f3cf640d6309ab52

  • C:\Users\Admin\AppData\Local\Temp\misids.exe

    Filesize

    315B

    MD5

    a34ac19f4afae63adc5d2f7bc970c07f

    SHA1

    a82190fc530c265aa40a045c21770d967f4767b8

    SHA256

    d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

    SHA512

    42e53d96e5961e95b7a984d9c9778a1d3bd8ee0c87b8b3b515fa31f67c2d073c8565afc2f4b962c43668c4efa1e478da9bb0ecffa79479c7e880731bc4c55765

  • memory/2032-17-0x00000000005D0000-0x00000000005D6000-memory.dmp

    Filesize

    24KB

  • memory/2032-23-0x00000000005A0000-0x00000000005A6000-memory.dmp

    Filesize

    24KB

  • memory/4976-0-0x00000000021D0000-0x00000000021D6000-memory.dmp

    Filesize

    24KB

  • memory/4976-1-0x0000000002050000-0x0000000002056000-memory.dmp

    Filesize

    24KB

  • memory/4976-8-0x00000000021D0000-0x00000000021D6000-memory.dmp

    Filesize

    24KB