Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/10/2024, 01:36

General

  • Target

    2024-10-09_b4acb064ad733695bb98baef5135c3c9_cryptolocker.exe

  • Size

    36KB

  • MD5

    b4acb064ad733695bb98baef5135c3c9

  • SHA1

    af7a0c47d4ec160d64d428efe951613f2a3a653e

  • SHA256

    1e5b597bc28190a2f3a4d46542febe7f2fa3eac1aec3c80b3ecd3407283e36b7

  • SHA512

    35db23874039b250abb37bf9a1ae58b7bc286f189306dc4870643b0bbc559ef34e37635619212d1f4ca7cfb3f87f854e0a53ab4156029210c3e4c66f8cfdb024

  • SSDEEP

    768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBVaDMLZSsplOrtu+:X6QFElP6n+gJQMOtEvwDpjBv1Q

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-09_b4acb064ad733695bb98baef5135c3c9_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-09_b4acb064ad733695bb98baef5135c3c9_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1268
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3088

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    36KB

    MD5

    c20f3a0a8bcb3357135e880629c7f851

    SHA1

    2828c38f7247324e4fe5a95bff599e985269dd14

    SHA256

    0a3d2f692964c56b437d41825c2ed5f7d60306b85637db9bb5d1bef243cc2bfd

    SHA512

    aab30f1dbbe428c818c15e5544790871219eab0e8fb4a8af9d5cac565d2a2e87f8b7d85b7e2292edb210fc47de231d3d6d144461fd6549525e3944a366d19324

  • memory/1268-0-0x0000000000660000-0x0000000000666000-memory.dmp

    Filesize

    24KB

  • memory/1268-1-0x0000000000660000-0x0000000000666000-memory.dmp

    Filesize

    24KB

  • memory/1268-2-0x00000000007D0000-0x00000000007D6000-memory.dmp

    Filesize

    24KB

  • memory/3088-18-0x00000000020F0000-0x00000000020F6000-memory.dmp

    Filesize

    24KB

  • memory/3088-17-0x00000000021D0000-0x00000000021D6000-memory.dmp

    Filesize

    24KB