Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/06/2024, 13:58

General

  • Target

    2024-06-14_b4ebc701cf15ee8ce2d2e755742859a1_cryptolocker.exe

  • Size

    39KB

  • MD5

    b4ebc701cf15ee8ce2d2e755742859a1

  • SHA1

    ff77ba6f6a6c9bfeb69d8a8a40a4ba987234c900

  • SHA256

    5ed8bcccd96582cb3c4404c3ae9ce872034ed635b831ac03fefe9d3729723723

  • SHA512

    3aae81756a3bad3ddc55f6a3fb921c145b9bedb36db8f6f63dfa88dc5d80386e135e35c01af1079cde283e7b626b26e2ade7e09426b369b60b9c80eae394eccf

  • SSDEEP

    768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYaBsYG:qDdFJy3QMOtEvwDpjjWMl7TdvG

Score
9/10
upx

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • Detection of Cryptolocker Samples 5 IoCs
  • UPX dump on OEP (original entry point) 5 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-14_b4ebc701cf15ee8ce2d2e755742859a1_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-14_b4ebc701cf15ee8ce2d2e755742859a1_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1572
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:3444

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    39KB

    MD5

    449886dc6295cf31868fd37994326572

    SHA1

    dbbfa26d8163d476ce53e40d57227f28b3243141

    SHA256

    8950ae765264c97f556d2bf6fdf7a05a752eaf4915fb65e32508f8c8ed392db1

    SHA512

    aa328c2733065202933f9c534e0d3620a4fd636f8ead56f06325353671a0da7689a03ef092ab1a3bc9b23931cad576b6d68cce41841c93e44a9c2bb6b2cad760

  • memory/1572-0-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/1572-1-0x00000000004E0000-0x00000000004E6000-memory.dmp

    Filesize

    24KB

  • memory/1572-2-0x00000000006E0000-0x00000000006E6000-memory.dmp

    Filesize

    24KB

  • memory/1572-9-0x00000000004E0000-0x00000000004E6000-memory.dmp

    Filesize

    24KB

  • memory/1572-17-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/3444-19-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/3444-26-0x0000000000630000-0x0000000000636000-memory.dmp

    Filesize

    24KB

  • memory/3444-20-0x0000000000650000-0x0000000000656000-memory.dmp

    Filesize

    24KB

  • memory/3444-27-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB