Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/06/2024, 06:15

General

  • Target

    2024-06-10_cb66f2aaf85b434bd6af3269533cb1f5_cryptolocker.exe

  • Size

    63KB

  • MD5

    cb66f2aaf85b434bd6af3269533cb1f5

  • SHA1

    314fc276a76a34e62b53a26b8d0ed03c9820bd33

  • SHA256

    60a1ddf20dba95b94f053511d5f63b4d3ddb30c60f17296059bd5bbf0c99837e

  • SHA512

    66c0ac7e552f0ef4d673d6bcacd6ed2e365ce05f3b9c05d625006bfba9417be0a662d9f46bb81b9949472f38366f5b805bee1162752a9e3edf10d3249369ac0b

  • SSDEEP

    1536:btB9g/xtCSKfxLIc//Xr+/AO/kIZ3ft2nVuTKB6nggOlHdUHZnx8:btng54SMLr+/AO/kIhfoKMHda2

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-10_cb66f2aaf85b434bd6af3269533cb1f5_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-10_cb66f2aaf85b434bd6af3269533cb1f5_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3904
    • C:\Users\Admin\AppData\Local\Temp\gewos.exe
      "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      PID:1804

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\gewos.exe

    Filesize

    63KB

    MD5

    b0b052ca31aaf82ad07052ddcacee9b0

    SHA1

    7b39d08b13c39ff3bf0da7871ffd758898fc2bb7

    SHA256

    ffaf2646ba6fab93fd2395fa495312875fbc178f46d2a793c143a801a6afc2b3

    SHA512

    e8ba1eed4394866feb457b88ef0213fe9d54977923223f7ffb1d466b99245e0ac17dd538ba798be9490c3e775bdfb0307b82b370b5118ea53faa9d3c32401dca

  • C:\Users\Admin\AppData\Local\Temp\gewosik.exe

    Filesize

    185B

    MD5

    4f1929f5a0d95ae73abb62736e03d7df

    SHA1

    5bd26f8551495ef697681dcebb49f57b1a47a7f1

    SHA256

    ee18da8a45a3de4faac69a0bde3c738e15ad2ad986e84491ac00a6b9f825181f

    SHA512

    369e2d80981344ed7b06573c42e985d2c107a1c344e29ba4c4c7c48a14d382d2662b7c5a729c2ad98ef314fe1ceb45b28fcf450f854d952620480bc89b18acde

  • memory/1804-25-0x0000000001F90000-0x0000000001F96000-memory.dmp

    Filesize

    24KB

  • memory/3904-8-0x00000000021D0000-0x00000000021D6000-memory.dmp

    Filesize

    24KB

  • memory/3904-1-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/3904-0-0x00000000021D0000-0x00000000021D6000-memory.dmp

    Filesize

    24KB