Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
89s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
02/02/2024, 03:27
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-02_3bfd8b21a50c467c67784cbe9fae448b_cryptolocker.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-02_3bfd8b21a50c467c67784cbe9fae448b_cryptolocker.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-02-02_3bfd8b21a50c467c67784cbe9fae448b_cryptolocker.exe
-
Size
48KB
-
MD5
3bfd8b21a50c467c67784cbe9fae448b
-
SHA1
7e1461d78fa167d5276bf7d64ed4fe6de8d002aa
-
SHA256
b0451da6fe0ea8d2dd931e203b9cabbc5cecdeddc7562c67803cb16bfc653158
-
SHA512
fdfb85e7c9c414c0e83125ad6b8b6edc3b65010e3ffe1aa54738808b549f161631a73c4387a025a705b8852698b2c2d55e2142a3f7446a2fae5a032d2d4524f3
-
SSDEEP
1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszsbKY1xzpAID:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7o
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
resource yara_rule behavioral2/files/0x000a0000000230f9-12.dat CryptoLocker_rule2 -
Detection of Cryptolocker Samples 1 IoCs
resource yara_rule behavioral2/files/0x000a0000000230f9-12.dat CryptoLocker_set1 -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation 2024-02-02_3bfd8b21a50c467c67784cbe9fae448b_cryptolocker.exe Key value queried \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation hurok.exe -
Executes dropped EXE 1 IoCs
pid Process 3076 hurok.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1432 wrote to memory of 3076 1432 2024-02-02_3bfd8b21a50c467c67784cbe9fae448b_cryptolocker.exe 87 PID 1432 wrote to memory of 3076 1432 2024-02-02_3bfd8b21a50c467c67784cbe9fae448b_cryptolocker.exe 87 PID 1432 wrote to memory of 3076 1432 2024-02-02_3bfd8b21a50c467c67784cbe9fae448b_cryptolocker.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-02_3bfd8b21a50c467c67784cbe9fae448b_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-02_3bfd8b21a50c467c67784cbe9fae448b_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\hurok.exe"C:\Users\Admin\AppData\Local\Temp\hurok.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
PID:3076
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD5da3faf22af078f6865341bab8bd4f166
SHA1b935ad0cfbde907d94480c7c5b39f172ca58915a
SHA25697f2c339f90cf344d73cfb544283db73917903abce93eee0ce0a0f92524bd019
SHA51242ecebcc358955641328dc4866b84d9f33ecfc0e9b40435dd9c4e76fb554abf99ad26551f0777c8dad8aef8b56cd3a422eacba5ed359e749930230bc8e6d0075