Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/06/2024, 08:29

General

  • Target

    2024-06-02_f8d1908df7db87d55000ec3f568be648_cryptolocker.exe

  • Size

    47KB

  • MD5

    f8d1908df7db87d55000ec3f568be648

  • SHA1

    0009c365635abb7a297a90e789e8f4855413e586

  • SHA256

    c67ad8fc202dd778adcf45477b5a7a13bfe898a9d9dff970321cc9e0c16fb2d5

  • SHA512

    0278870a92668088785801ef26f626e2899740cee3c964b4a055ca9d12b3060cad4d13931dd063dad54a80236c276cb6817f50d934364156c2269a1d7351eb28

  • SSDEEP

    768:P6LsoEEeegiZPvEhHS5+Mh/QtOOtEvwDpjBpaD3TUogs/VXpAPkZ:P6QFElP6k+MRQMOtEvwDpjBQpVX1Z

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • Detection of Cryptolocker Samples 5 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-02_f8d1908df7db87d55000ec3f568be648_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-02_f8d1908df7db87d55000ec3f568be648_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3436
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:3720

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    47KB

    MD5

    5e7cb81c94403835f685ecf4d1ebec30

    SHA1

    56866db9e5d9d0cd38bb080524f0a2a33003ebe6

    SHA256

    eaaef460217d569faf3d3ca9b05305980625191b08336074f047f80cd858d051

    SHA512

    a3e89ae03e92d5f26c94268db6075d738e89676e7bd97ef113160afddb45b58c4dcc33ae5d906eb3ab105cfa34ba7a1c7e7d3d04cb8d07eda3b8e54eeaffe31c

  • memory/3436-0-0x0000000000500000-0x000000000050B000-memory.dmp

    Filesize

    44KB

  • memory/3436-1-0x00000000005A0000-0x00000000005A6000-memory.dmp

    Filesize

    24KB

  • memory/3436-2-0x00000000005C0000-0x00000000005C6000-memory.dmp

    Filesize

    24KB

  • memory/3436-9-0x00000000005A0000-0x00000000005A6000-memory.dmp

    Filesize

    24KB

  • memory/3436-17-0x0000000000500000-0x000000000050B000-memory.dmp

    Filesize

    44KB

  • memory/3720-18-0x0000000000500000-0x000000000050B000-memory.dmp

    Filesize

    44KB

  • memory/3720-20-0x0000000002090000-0x0000000002096000-memory.dmp

    Filesize

    24KB

  • memory/3720-26-0x00000000004A0000-0x00000000004A6000-memory.dmp

    Filesize

    24KB

  • memory/3720-27-0x0000000000500000-0x000000000050B000-memory.dmp

    Filesize

    44KB