Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/06/2024, 02:31

General

  • Target

    2024-06-17_e4d4a2c0d14559aadb6ba1977b781d49_cryptolocker.exe

  • Size

    49KB

  • MD5

    e4d4a2c0d14559aadb6ba1977b781d49

  • SHA1

    d6b152aa3f8f259b7c47b96cfa34c2d6c219dfaa

  • SHA256

    b1c9c340c07d9053d8f2d1baa245d017e861c94f123c23857201349090e1c093

  • SHA512

    818c1accdf749f187ef3b9a63a4b8e718dddf023be22b99efb58d804683273e94e037fc2c82c9c0bae3deecf2c2440754379193543a1cc04995bf1f082a4d644

  • SSDEEP

    768:bIDOw9UiaCHfjnE0Sf88AvvP1oghYvm9/6D8jnPx9UnuDLlD+w1:bIDOw9a0Dwo3P1ojvUSD4PInyDP

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-17_e4d4a2c0d14559aadb6ba1977b781d49_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-17_e4d4a2c0d14559aadb6ba1977b781d49_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4540
    • C:\Users\Admin\AppData\Local\Temp\lossy.exe
      "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
      2⤵
      • Executes dropped EXE
      PID:3028
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3028,i,7977653611488681184,6839495125838449898,262144 --variations-seed-version --mojo-platform-channel-handle=4044 /prefetch:8
    1⤵
      PID:3220

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\lossy.exe

      Filesize

      49KB

      MD5

      45c11bfe8255a3f9ff6343c78ecd26fc

      SHA1

      1efc5bd762922deb0672d3c6a872d225a0775679

      SHA256

      938522900dd76cbdb86646633b1e3d66add80ac6c4e229c8a0531435f0f02c32

      SHA512

      3758808132b3a5c98a029dcce9b90d5db02bb4031831d5c745f2db786cc09e52d8ecc35df2637033f23cef48a4f5b5d2af9ccc50d4ec5861b36fb4995484aefa

    • memory/3028-17-0x0000000002060000-0x0000000002066000-memory.dmp

      Filesize

      24KB

    • memory/3028-23-0x0000000002140000-0x0000000002146000-memory.dmp

      Filesize

      24KB

    • memory/4540-1-0x00000000005B0000-0x00000000005B6000-memory.dmp

      Filesize

      24KB

    • memory/4540-0-0x0000000000590000-0x0000000000596000-memory.dmp

      Filesize

      24KB

    • memory/4540-8-0x0000000000590000-0x0000000000596000-memory.dmp

      Filesize

      24KB