Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    0s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/06/2024, 07:27

General

  • Target

    2024-06-09_627e1fbec0f24b814f63eee5ee1f71ad_cryptolocker.exe

  • Size

    49KB

  • MD5

    627e1fbec0f24b814f63eee5ee1f71ad

  • SHA1

    fb112f3589417d4c2d8932f37ff933dbe91c047c

  • SHA256

    667c2e5182c05bfe7e8173b88c696003b89b808a3469f2c5b89ce6e02bd52461

  • SHA512

    01d6eb2220469b070ecb9a0a85f69c38af254d6aac7c5ff85e23766e2a5c526873ae19493ed575fe0f82908abb8f3ccc98e1369c432bf1973ec00309e22b1ddb

  • SSDEEP

    768:P6LsoVEeegiZPvEhHSP+gp/QtOOtEvwDpjBBMLZdzuqpXsiE8Wq/DpkcAYZG:P6Q0ElP6G+gJQMOtEvwDpjB8WMlf/ZG

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • Detection of Cryptolocker Samples 5 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-09_627e1fbec0f24b814f63eee5ee1f71ad_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-09_627e1fbec0f24b814f63eee5ee1f71ad_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:5056
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:1312

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    49KB

    MD5

    9c3df63ca77468416988ce33cd2c0959

    SHA1

    8d923267c08a9d3d25da1ce9757ef6072fe02fd6

    SHA256

    fd208dc01735b01dfed61710a767c3b77d92717a1cf68f24a9c2f7e5c158bc6c

    SHA512

    3f256402f12f3e8d0fbd5802595508fa62ef6b9cce7d3cecfe2673b5e9763dc8c7bfa2a7f92141ae08e70f4ea0a87425b2169a30a1348535ced3904afa026dd7

  • memory/1312-16-0x0000000000500000-0x000000000050B000-memory.dmp

    Filesize

    44KB

  • memory/1312-20-0x0000000002050000-0x0000000002056000-memory.dmp

    Filesize

    24KB

  • memory/1312-26-0x00000000021D0000-0x00000000021D6000-memory.dmp

    Filesize

    24KB

  • memory/1312-27-0x0000000000500000-0x000000000050B000-memory.dmp

    Filesize

    44KB

  • memory/5056-0-0x0000000000500000-0x000000000050B000-memory.dmp

    Filesize

    44KB

  • memory/5056-1-0x0000000000620000-0x0000000000626000-memory.dmp

    Filesize

    24KB

  • memory/5056-2-0x0000000000750000-0x0000000000756000-memory.dmp

    Filesize

    24KB

  • memory/5056-9-0x0000000000620000-0x0000000000626000-memory.dmp

    Filesize

    24KB

  • memory/5056-18-0x0000000000500000-0x000000000050B000-memory.dmp

    Filesize

    44KB