Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/10/2024, 07:25

General

  • Target

    2024-10-10_2ebb6e0528318479b82075f8bcdb7152_cryptolocker.exe

  • Size

    49KB

  • MD5

    2ebb6e0528318479b82075f8bcdb7152

  • SHA1

    1e4f0bde545064b6938b153ccb8f5bef2ee0b322

  • SHA256

    8b352d53a178903812c6b55ac00b8e41caa03e39d1aecae0fa0adc60915f739f

  • SHA512

    1fd380499b522bed23d5f378209dc9e778eb1b6b482bd9ef0708b86dc2df3237d5c7ff3b3cc157817ed20981e4ac015c83be419429e576b4f76c73ed005f8bed

  • SSDEEP

    1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb6ImpU:BbdDmjr+OtEvwDpjMi

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-10_2ebb6e0528318479b82075f8bcdb7152_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-10_2ebb6e0528318479b82075f8bcdb7152_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3104
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2696

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    50KB

    MD5

    8c293d6b0a590946e31c92e5698b98d7

    SHA1

    a5d67ab929959381745e6ef15f20d722c9f19d11

    SHA256

    fa6437d2a93750a490336f56790d6a88c4195bf5817143129aae7c82fccedae3

    SHA512

    8a4fec42eca44a63868f8b4bb3551e54056d22156f8d7a414308fbd929fed1eecaeb41ce21d01d442ab3b0f15ad52b2fbe78da2ee7aa05b5d9fcca341a213fd6

  • memory/2696-20-0x0000000002100000-0x0000000002106000-memory.dmp

    Filesize

    24KB

  • memory/2696-26-0x00000000004E0000-0x00000000004E6000-memory.dmp

    Filesize

    24KB

  • memory/2696-27-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/3104-0-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/3104-1-0x00000000006A0000-0x00000000006A6000-memory.dmp

    Filesize

    24KB

  • memory/3104-2-0x00000000006A0000-0x00000000006A6000-memory.dmp

    Filesize

    24KB

  • memory/3104-3-0x00000000006C0000-0x00000000006C6000-memory.dmp

    Filesize

    24KB

  • memory/3104-18-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB