Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/06/2024, 21:32

General

  • Target

    2024-06-27_dda2c6c0d4039d332ef28d229f43aa9f_cryptolocker.exe

  • Size

    46KB

  • MD5

    dda2c6c0d4039d332ef28d229f43aa9f

  • SHA1

    c219bd7eee294ae4df72047ea3422294e0f204b5

  • SHA256

    2ebc16621d60e82d99f4647c14a63da2a1d3423d11c807a01de15f8f309edfab

  • SHA512

    824bef276bb360f28200506367baf8f9c2224cb566f66b0b67f6e25771294adec493c8eac06fcf07441be3afb6896fc23302cd575b912de004336e71c5f13ff9

  • SSDEEP

    768:bao/2n1TCraU6GD1a4X1XOQ69zbjlAAX5e9z1:bF/y2lFizbR9Xwz1

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-27_dda2c6c0d4039d332ef28d229f43aa9f_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-27_dda2c6c0d4039d332ef28d229f43aa9f_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2456
    • C:\Users\Admin\AppData\Local\Temp\rewok.exe
      "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
      2⤵
      • Executes dropped EXE
      PID:528

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\rewok.exe

    Filesize

    46KB

    MD5

    c47c7c9ff037b3c2164a8c5821086cba

    SHA1

    94c69a4802980f64d6658d0cde9a5d756873052f

    SHA256

    cb7c2f1c9905dba2f21ec133aa8b404aa40c985616627bc72939f76330361d36

    SHA512

    72caa54a2357f06cae611c893379f7a2d3f6bce1302990f69db08d7690f371e26ebd23df4c292dede3cfc26751452f3764819f909842e0c01b4091386391d6e8

  • memory/528-25-0x0000000000790000-0x0000000000796000-memory.dmp

    Filesize

    24KB

  • memory/2456-0-0x0000000002250000-0x0000000002256000-memory.dmp

    Filesize

    24KB

  • memory/2456-1-0x0000000002250000-0x0000000002256000-memory.dmp

    Filesize

    24KB

  • memory/2456-2-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB