Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/06/2024, 08:25

General

  • Target

    2024-06-01_5d5008fe06603752e27c93cf7860d982_cryptolocker.exe

  • Size

    46KB

  • MD5

    5d5008fe06603752e27c93cf7860d982

  • SHA1

    34884431a600f265806ef8b23b7929f4227ebf9f

  • SHA256

    f0fd4957cd45f766244bac22e0571c4cc155360ee2a476657c1bcb811df50043

  • SHA512

    b3b344d42a9bcd1bead4e80093aee84ac11b3b16fa388c00c4aea203e4e93dce34d2c3a61d259eb345f8e33428c70ca80b919958f10b6e3e95fdce36072ded00

  • SSDEEP

    768:b7o/2n1TCraU6GD1a4X0WcO+wMVm+slAMphqc:bc/y2lkF0+Beqc

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-01_5d5008fe06603752e27c93cf7860d982_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-01_5d5008fe06603752e27c93cf7860d982_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:5040
    • C:\Users\Admin\AppData\Local\Temp\rewok.exe
      "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
      2⤵
      • Executes dropped EXE
      PID:3016

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\rewok.exe

    Filesize

    46KB

    MD5

    dd9c1eeb1f7372723c756eb26493d22a

    SHA1

    e6081ccd907579531fa59023071e37ce3a128a9a

    SHA256

    2abbe100b3c0068eb3ca3ceba3319d9a1197d41652279ff291f0a8022166c0f4

    SHA512

    14874d328289383860016643ab6e690dfb7d9ed9fe6f835b65fb438f4dba6121ff4506a173b215e7d4be495c568c34e8e35a1e360a2cf1e18addcdd410886d25

  • memory/3016-25-0x0000000002120000-0x0000000002126000-memory.dmp

    Filesize

    24KB

  • memory/5040-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

    Filesize

    24KB

  • memory/5040-1-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/5040-8-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

    Filesize

    24KB