Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    95s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/09/2024, 03:24

General

  • Target

    2024-09-06_e062e01442a5678019170d693ed6a792_cryptolocker.exe

  • Size

    56KB

  • MD5

    e062e01442a5678019170d693ed6a792

  • SHA1

    f29a5fd0bd0621b9ff6be588578a1e8875fba162

  • SHA256

    113c221f6a62b4a84a7aa35c34f1ed3fce6945e0777df1f161dcb8d30bd61d50

  • SHA512

    6d3562145422279bc73f2ee18f3f8d4e3bf5cb040ca441d19b8305086091bc60a931695f9673102b8e57c0f41d32f1e73cfc8733e2cf59fc7fbd3bd5776f88da

  • SSDEEP

    1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszsbKY1xzpAIX6EA:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7B

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-09-06_e062e01442a5678019170d693ed6a792_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-09-06_e062e01442a5678019170d693ed6a792_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2920
    • C:\Users\Admin\AppData\Local\Temp\hurok.exe
      "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:64

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\hurok.exe

    Filesize

    56KB

    MD5

    1b5b915f47abcfa5cbd36585fe93f3e8

    SHA1

    20196a11a26b040fd61a90fa9818bc607691fbe4

    SHA256

    2b93319706fae0494f886c9585baf95eb06084cd96df2a66b5bd7244deb915d8

    SHA512

    85608fa39df3eb3705cd01b0e4db9242d4a4092d93e774c90268f0bfde42da9ff5bee241a5de87bb78ed3a68aa8249e020266758cdd1dcc6ed6b9e55cb48ab52

  • memory/64-25-0x00000000020D0000-0x00000000020D6000-memory.dmp

    Filesize

    24KB

  • memory/2920-0-0x00000000005E0000-0x00000000005E6000-memory.dmp

    Filesize

    24KB

  • memory/2920-1-0x00000000005E0000-0x00000000005E6000-memory.dmp

    Filesize

    24KB

  • memory/2920-2-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB