Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/10/2024, 02:20

General

  • Target

    2024-10-15_b092bf331d143a3862e5d943a79e12e2_cryptolocker.exe

  • Size

    47KB

  • MD5

    b092bf331d143a3862e5d943a79e12e2

  • SHA1

    8e47e5beebd9182aaf7473937b1bcd9907d306d4

  • SHA256

    3be47e7b7d1f3386feeb68650ac6287e83b1349d46fd28a3a5d9627e2429caae

  • SHA512

    31f2d08bab3c3d47424c93c6280855387c26b8b59ecf85f18db855ac69d773d9754034d37f807443b02da809f2797a22ae7ccb497a9e15251003842e3833c40a

  • SSDEEP

    768:bODOw9UiamWUB2preAr+OfjH/0STX73OBqO6iv:bODOw9acifH+Yziv

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-15_b092bf331d143a3862e5d943a79e12e2_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-15_b092bf331d143a3862e5d943a79e12e2_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4108
    • C:\Users\Admin\AppData\Local\Temp\lossy.exe
      "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      PID:1688

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\lossy.exe

    Filesize

    47KB

    MD5

    7a474df9f7f4e0013756a3287d5e347f

    SHA1

    a49dd2b89c7faa00ecf2fa3ebb08e11fc8ef017d

    SHA256

    8b52acaa64702e7117f646eb002aff754a6a7180b187d200c2b1d499e3d55a02

    SHA512

    d22786842eb0abe551d330f9ed5b6ae87d715ea5e324019dbbb8bc22bd41be2f5f4c821ce3ec70605aaf57133f1aa94611cd030ef7cc6307d642d2741151c9dd

  • C:\Users\Admin\AppData\Local\Temp\swenled.exe

    Filesize

    537B

    MD5

    590a2a16db7c9454e5429278e1e95347

    SHA1

    11dd68b8c510df635ff033c58fa002fdcd196927

    SHA256

    c5ffd9dbef8cebbf04436e0680847b95be3f8140e3b3d1e99fe7e743799dfd97

    SHA512

    7e55708920fe2541ab1236c7616d67fd85795e80bc5f399d9b101372c347534940f2f81d942bb094c2d188b23a3501439443afbc0ca142758708c909c009cfa3

  • memory/1688-19-0x00000000004D0000-0x00000000004D6000-memory.dmp

    Filesize

    24KB

  • memory/1688-20-0x00000000004F0000-0x00000000004F6000-memory.dmp

    Filesize

    24KB

  • memory/1688-50-0x0000000008000000-0x000000000800F000-memory.dmp

    Filesize

    60KB

  • memory/4108-0-0x0000000008000000-0x000000000800F000-memory.dmp

    Filesize

    60KB

  • memory/4108-1-0x00000000006E0000-0x00000000006E6000-memory.dmp

    Filesize

    24KB

  • memory/4108-2-0x00000000006E0000-0x00000000006E6000-memory.dmp

    Filesize

    24KB

  • memory/4108-3-0x00000000021A0000-0x00000000021A6000-memory.dmp

    Filesize

    24KB

  • memory/4108-17-0x0000000008000000-0x000000000800F000-memory.dmp

    Filesize

    60KB