Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
18/02/2024, 17:58
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-18_993ce01700b212fd5dfb6be25976d3be_cryptolocker.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-18_993ce01700b212fd5dfb6be25976d3be_cryptolocker.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-02-18_993ce01700b212fd5dfb6be25976d3be_cryptolocker.exe
-
Size
385KB
-
MD5
993ce01700b212fd5dfb6be25976d3be
-
SHA1
f4f04dc37cac40991ce97e0325c0315d1f000d86
-
SHA256
44abb9bc47cc6eaf574acf883a16afe9d07ecef8fcb6c1f0bb9099292d3493a5
-
SHA512
0e757fcaa0a4bad86eb4e7335ec038d093397897138b85aa5d1c031571a7d6b044e32daa632323bf42c9545b96e7a03eac150192f2f78e6b2cc775dad0ab2ded
-
SSDEEP
6144:nnOsaQgAOjvrZFODJjBz3j1jTqQy6v2GGnugOtihzXK:nnOflT/ZFIjBz3xjTxynGUOUhXK
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
resource yara_rule behavioral2/files/0x00070000000231fd-12.dat CryptoLocker_rule2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation 2024-02-18_993ce01700b212fd5dfb6be25976d3be_cryptolocker.exe -
Executes dropped EXE 1 IoCs
pid Process 1672 hasfj.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4336 wrote to memory of 1672 4336 2024-02-18_993ce01700b212fd5dfb6be25976d3be_cryptolocker.exe 85 PID 4336 wrote to memory of 1672 4336 2024-02-18_993ce01700b212fd5dfb6be25976d3be_cryptolocker.exe 85 PID 4336 wrote to memory of 1672 4336 2024-02-18_993ce01700b212fd5dfb6be25976d3be_cryptolocker.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-18_993ce01700b212fd5dfb6be25976d3be_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-18_993ce01700b212fd5dfb6be25976d3be_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\hasfj.exe"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"2⤵
- Executes dropped EXE
PID:1672
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
385KB
MD58f286f1422d72e41f6bc7528aff0611e
SHA1bfeb86ab045bacbffda1823a53b3444aa95003f5
SHA2560bb57db8a098cc3180ef28a933d03b28ada3817673113ab74a021ee35ebe2987
SHA51264b93c36b2200835995f1a64cc4f72d479c4b595c1a452fa29da133b09f02510a94888e016990ef3be43a235619cbe3594c85ed16a3e8d22dd71e37661fbdbf5