Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/01/2024, 00:43
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-26_15ff4caaa5aab79e7b478adbfb343dba_cryptolocker.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-26_15ff4caaa5aab79e7b478adbfb343dba_cryptolocker.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-26_15ff4caaa5aab79e7b478adbfb343dba_cryptolocker.exe
-
Size
46KB
-
MD5
15ff4caaa5aab79e7b478adbfb343dba
-
SHA1
48e41479bf17d018555d0b248ca9cc682dfe3929
-
SHA256
76853f3aeea8838c29a807feb94f8ffba9bdef532b0986fae464db548b798bcf
-
SHA512
38b4267cf79c88ceef85175dfa6f94d1bad0c69c4525654f5bce374029c5d731076d9dafd7b9a294ebed2048729f9d482513fc966a25b6fa97c2641fa15e1358
-
SSDEEP
768:bgX4zYcgTEu6QOaryfjqDlC6JFbK37YbDu5z/hDu:bgGYcA/53GAA6y37nby
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
resource yara_rule behavioral1/files/0x000b000000012234-10.dat CryptoLocker_rule2 -
Executes dropped EXE 1 IoCs
pid Process 2004 hasfj.exe -
Loads dropped DLL 1 IoCs
pid Process 1888 2024-01-26_15ff4caaa5aab79e7b478adbfb343dba_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1888 wrote to memory of 2004 1888 2024-01-26_15ff4caaa5aab79e7b478adbfb343dba_cryptolocker.exe 28 PID 1888 wrote to memory of 2004 1888 2024-01-26_15ff4caaa5aab79e7b478adbfb343dba_cryptolocker.exe 28 PID 1888 wrote to memory of 2004 1888 2024-01-26_15ff4caaa5aab79e7b478adbfb343dba_cryptolocker.exe 28 PID 1888 wrote to memory of 2004 1888 2024-01-26_15ff4caaa5aab79e7b478adbfb343dba_cryptolocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_15ff4caaa5aab79e7b478adbfb343dba_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-26_15ff4caaa5aab79e7b478adbfb343dba_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\hasfj.exe"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"2⤵
- Executes dropped EXE
PID:2004
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD57eef71cf97b1b3fd1ae6fc9f980dd8ea
SHA17a19d5d30c25bb8ac1b0753497710e97ab1dfde0
SHA2561081a25480f085bf7243860256528e8a35275a95e74e1b52761ec5a05d19f3f5
SHA512288b2716fa4dab82c9af5e6de35c9163b762ada4f07002eba6a4635460e1e361ac28d6cdb14302735e012346be8369bbb2838535879d80c1153f25dabad806ea