Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
18/02/2024, 10:24
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-18_1f85c04217edd9533988b97eaac95e48_cryptolocker.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-18_1f85c04217edd9533988b97eaac95e48_cryptolocker.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-02-18_1f85c04217edd9533988b97eaac95e48_cryptolocker.exe
-
Size
40KB
-
MD5
1f85c04217edd9533988b97eaac95e48
-
SHA1
757e5fe292aad93b47d79d35c8e6cf0a9a872581
-
SHA256
a4cae695c39b7d99ae6d2ed97b854a3f33449d60c9755449990a4443704c8d7f
-
SHA512
3462418798769dbbce68629aee201e556213102934079f13605ff97957e917222cf1f7fcac0dbec6602bc242e8dc80db757eb3dee5e0f09d8732cfb3285f561a
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqh6/CtVw:6j+1NMOtEvwDpjrR2Vw
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
resource yara_rule behavioral2/memory/680-0-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_rule2 behavioral2/files/0x0007000000023222-13.dat CryptoLocker_rule2 behavioral2/memory/680-17-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_rule2 behavioral2/memory/2472-25-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_rule2 -
Detection of Cryptolocker Samples 4 IoCs
resource yara_rule behavioral2/memory/680-0-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_set1 behavioral2/files/0x0007000000023222-13.dat CryptoLocker_set1 behavioral2/memory/680-17-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_set1 behavioral2/memory/2472-25-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_set1 -
Detects executables built or packed with MPress PE compressor 4 IoCs
resource yara_rule behavioral2/memory/680-0-0x0000000000500000-0x000000000050F000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/files/0x0007000000023222-13.dat INDICATOR_EXE_Packed_MPress behavioral2/memory/680-17-0x0000000000500000-0x000000000050F000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/2472-25-0x0000000000500000-0x000000000050F000-memory.dmp INDICATOR_EXE_Packed_MPress -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation 2024-02-18_1f85c04217edd9533988b97eaac95e48_cryptolocker.exe -
Executes dropped EXE 1 IoCs
pid Process 2472 misid.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 680 wrote to memory of 2472 680 2024-02-18_1f85c04217edd9533988b97eaac95e48_cryptolocker.exe 84 PID 680 wrote to memory of 2472 680 2024-02-18_1f85c04217edd9533988b97eaac95e48_cryptolocker.exe 84 PID 680 wrote to memory of 2472 680 2024-02-18_1f85c04217edd9533988b97eaac95e48_cryptolocker.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-18_1f85c04217edd9533988b97eaac95e48_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-18_1f85c04217edd9533988b97eaac95e48_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
PID:2472
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD50beecfeab4e7b26bece558c7af61f36d
SHA191b3e4b5583075023d1ad02f9335c1ba9a6287d1
SHA256b4d35604c69bbf7663d8fba849d7a6be2f6b24976948444c7c73244630bdd558
SHA512563f9fd39ae9c7f0f4cca86a03c64f74dfb8ec08f1ca4a958efd5eb07b62c3874af52695ce70350a6f78ea587a71b10c3304299910865ce6cf93615e5e0a9fc5