Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
04/02/2024, 17:34
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-04_dbc34bc5ec493f1f677497fa259cc0ab_cryptolocker.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-04_dbc34bc5ec493f1f677497fa259cc0ab_cryptolocker.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-02-04_dbc34bc5ec493f1f677497fa259cc0ab_cryptolocker.exe
-
Size
50KB
-
MD5
dbc34bc5ec493f1f677497fa259cc0ab
-
SHA1
37ba37650a2a75be1ee98ceac9795baca84d9e88
-
SHA256
954af40b8d0417c374d845f881080e76d2c8dd5204ff646ffef7c88bbc92163f
-
SHA512
df442691cb305276c0982254793a03a99ad8a367e3ef15068dfb690d1378632671d658bda611c5f9ca615e873ec12d932f0939d47643a6fe57f1cc2cb59be5ce
-
SSDEEP
768:XS5nQJ24LR1bytOOtEvwDpjNbZ7uyA36S7MzF3FP:i5nkFGMOtEvwDpjNbwQEqV
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
resource yara_rule behavioral2/memory/4032-0-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_rule2 behavioral2/files/0x000700000002320f-13.dat CryptoLocker_rule2 behavioral2/memory/4032-17-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_rule2 behavioral2/memory/4460-54-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_rule2 -
Detection of Cryptolocker Samples 2 IoCs
resource yara_rule behavioral2/memory/4032-17-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_set1 behavioral2/memory/4460-54-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_set1 -
Detects executables built or packed with MPress PE compressor 4 IoCs
resource yara_rule behavioral2/memory/4032-0-0x0000000000500000-0x000000000050F000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/files/0x000700000002320f-13.dat INDICATOR_EXE_Packed_MPress behavioral2/memory/4032-17-0x0000000000500000-0x000000000050F000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/4460-54-0x0000000000500000-0x000000000050F000-memory.dmp INDICATOR_EXE_Packed_MPress -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation 2024-02-04_dbc34bc5ec493f1f677497fa259cc0ab_cryptolocker.exe Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation misid.exe -
Executes dropped EXE 1 IoCs
pid Process 4460 misid.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4032 wrote to memory of 4460 4032 2024-02-04_dbc34bc5ec493f1f677497fa259cc0ab_cryptolocker.exe 87 PID 4032 wrote to memory of 4460 4032 2024-02-04_dbc34bc5ec493f1f677497fa259cc0ab_cryptolocker.exe 87 PID 4032 wrote to memory of 4460 4032 2024-02-04_dbc34bc5ec493f1f677497fa259cc0ab_cryptolocker.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-04_dbc34bc5ec493f1f677497fa259cc0ab_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-04_dbc34bc5ec493f1f677497fa259cc0ab_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
PID:4460
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50KB
MD58f57907f5062f36857d3c5f30b5dadcf
SHA1dbf6a8b47ec3a6f8fd1fe5e074d0a8408f3284db
SHA2563d60f43cdd19786c0ac25730878fa4f55be92eed6564a5e16a9e32d9bea03494
SHA512569cdd302f6e22ea194dcccdf8429bad6379d9e04a8c2dfe639c2b86df933e869069f1a74d239c7cbb5c23ad3630cf0f21652dcaa049238d7b38bbef65de3615