Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/10/2024, 16:32

General

  • Target

    2024-10-10_62f122ce78c25ef8be32c233766d99b8_cryptolocker.exe

  • Size

    31KB

  • MD5

    62f122ce78c25ef8be32c233766d99b8

  • SHA1

    f6c0159df5ef7aff13e8c8062a590f52327ac775

  • SHA256

    5ac783aad87b804a8dc8e2a9507c14607c67beded2d9bb4a2d286c39ada8100f

  • SHA512

    751bb4ba44e7e0c5fc91b5299ecaf3e08a08b5df920fc8fc72c1fb28e8a312f13b7afbc3a2cd78ecd650707f93e60177fbc412ab7c37c6cc99bc087536d45cb7

  • SSDEEP

    384:bmM0V/YPvnr801TRoUGPh4TKt6ATt1DqgPa3s/zzo984:b7o/2n1TCraU6GD1a4XD4

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-10_62f122ce78c25ef8be32c233766d99b8_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-10_62f122ce78c25ef8be32c233766d99b8_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2964
    • C:\Users\Admin\AppData\Local\Temp\rewok.exe
      "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1220

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\rewok.exe

    Filesize

    32KB

    MD5

    1a4e50008983161f3f4a040dc818c7db

    SHA1

    400527dd3527d3e42941e3e57252aaa1d9cd2114

    SHA256

    65fa2d50d13c009d1ae56ece3d73f7759f92c2b492d00272c3c3ec2d7dc0957a

    SHA512

    be44be652c501736837fd6dfc6db392bc216867f8a12a5e56401193e5b3f0219e5d9bf73f873c959bd4b76d43f748a7c5447e838c57cfd120a22908a7794e7e3

  • memory/1220-25-0x0000000002120000-0x0000000002126000-memory.dmp

    Filesize

    24KB

  • memory/2964-0-0x00000000022C0000-0x00000000022C6000-memory.dmp

    Filesize

    24KB

  • memory/2964-1-0x00000000022C0000-0x00000000022C6000-memory.dmp

    Filesize

    24KB

  • memory/2964-2-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/2964-17-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB