Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
11/01/2024, 05:52
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-10_79272b79d999210e11dd2c8d51500a80_cryptolocker.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-10_79272b79d999210e11dd2c8d51500a80_cryptolocker.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-01-10_79272b79d999210e11dd2c8d51500a80_cryptolocker.exe
-
Size
130KB
-
MD5
79272b79d999210e11dd2c8d51500a80
-
SHA1
f21fa4af335e2e88956b8ef67cde7a49277b2c67
-
SHA256
82a0858cbca51c5c44f815861642668609bb69853f3a98914488b75404c48419
-
SHA512
389123a37b1f79cf1d23003a66960a5ec7713e58bdf5e78e5f021638fc9831fa36943496c160420c63af9b8968483c0a6ca469d7f017d5bbd5b765276bd66228
-
SSDEEP
1536:V6QFElP6n+gMQMOtEvwDpjQGYQbxGYQbxGYQbO:V6a+pOtEvwDpjt22C
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation 2024-01-10_79272b79d999210e11dd2c8d51500a80_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-10_79272b79d999210e11dd2c8d51500a80_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-10_79272b79d999210e11dd2c8d51500a80_cryptolocker.exe"1⤵
- Checks computer location settings
PID:824 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵PID:5116
-