Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/06/2024, 15:03

General

  • Target

    2024-06-20_8e9cefa6e7da3bb2c19dc1ada1c08777_cryptolocker.exe

  • Size

    63KB

  • MD5

    8e9cefa6e7da3bb2c19dc1ada1c08777

  • SHA1

    9494a250a3df18d7cf342efc4d0ee8c610c452d1

  • SHA256

    8646407a1b15fe08afba2b45205785c98fe432f4c6fc4c78a4f131aab820208c

  • SHA512

    5ab392f765a43fc11451e7b4377353d6cf2cbfa02ee92a01ede157a1f23dd7f7ce1d0cf93f4e3d0f44b7edb8108836721c4d674ea9bfd9e7d7ad49c5d2e3fe40

  • SSDEEP

    1536:btB9g/xtCSKfxLIc//Xr+/AO/kIZ3ft2nVuTKB6nggOlHdUHZnTD:btng54SMLr+/AO/kIhfoKMHda/

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-20_8e9cefa6e7da3bb2c19dc1ada1c08777_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-20_8e9cefa6e7da3bb2c19dc1ada1c08777_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1892
    • C:\Users\Admin\AppData\Local\Temp\gewos.exe
      "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      PID:2584

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\gewos.exe

    Filesize

    63KB

    MD5

    d97017f8fcf05eb1e92f120c198d948e

    SHA1

    42d6c60d74caf4506a1950a5198796dde4d49df5

    SHA256

    46413ae2535511d09cdfb0f48c521a63795acaa2428aa1e8317e2ed237c47e49

    SHA512

    00670101082d4afb7dd0ef4488439dfb3412f7c79d31e95ce509f7c2f408965f42e789d036f929e54459436412591d2640e956382fec24f079658f19011baffa

  • C:\Users\Admin\AppData\Local\Temp\gewosik.exe

    Filesize

    185B

    MD5

    03b31f0851a5ea5c6350b9937c145ffb

    SHA1

    71de6764e56294ca19462db50b257d8e62f7096e

    SHA256

    cb5f181f574cd0cc40cd8cef9cfc171fff40b8fa74267965fae719363555dcc0

    SHA512

    8cc3d22b391fb581ee4f94432f93e5cbf166dc80386524316df850b1c9256e758400b8dd2b52e90def28ac7be586f456c8612410ece3fde08c31226ced465516

  • memory/1892-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

    Filesize

    24KB

  • memory/1892-1-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/1892-8-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

    Filesize

    24KB