Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22/02/2024, 04:53
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-22_2aa2568022c7de0c425a20d9089fc3fb_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-02-22_2aa2568022c7de0c425a20d9089fc3fb_cryptolocker.exe
Resource
win10v2004-20240221-en
General
-
Target
2024-02-22_2aa2568022c7de0c425a20d9089fc3fb_cryptolocker.exe
-
Size
47KB
-
MD5
2aa2568022c7de0c425a20d9089fc3fb
-
SHA1
21fd0f7ad409568dc0e17ea26c051cda790e3365
-
SHA256
46708536747b6d711950bc3a6a632f7084ba29445ab14f67f012924731aca445
-
SHA512
eff7308f4f49f9dc5964e485bc6326301aa39b5b00131dc6a3eb00706c505a58acbcd3c668e609d312d96a1c32688744d988d641ce080ec982067d2b1d72bac0
-
SSDEEP
768:bgX4zYcgTEu6QOaryfjqDlC6JFbK37Yl6dmv:bgGYcA/53GAA6y37Q6dmv
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
resource yara_rule behavioral1/files/0x000b00000001222c-10.dat CryptoLocker_rule2 -
Executes dropped EXE 1 IoCs
pid Process 2220 hasfj.exe -
Loads dropped DLL 1 IoCs
pid Process 2260 2024-02-22_2aa2568022c7de0c425a20d9089fc3fb_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2260 wrote to memory of 2220 2260 2024-02-22_2aa2568022c7de0c425a20d9089fc3fb_cryptolocker.exe 28 PID 2260 wrote to memory of 2220 2260 2024-02-22_2aa2568022c7de0c425a20d9089fc3fb_cryptolocker.exe 28 PID 2260 wrote to memory of 2220 2260 2024-02-22_2aa2568022c7de0c425a20d9089fc3fb_cryptolocker.exe 28 PID 2260 wrote to memory of 2220 2260 2024-02-22_2aa2568022c7de0c425a20d9089fc3fb_cryptolocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-22_2aa2568022c7de0c425a20d9089fc3fb_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-22_2aa2568022c7de0c425a20d9089fc3fb_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\hasfj.exe"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"2⤵
- Executes dropped EXE
PID:2220
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD5bf8773151928555816378f92aeb4daf4
SHA125283c361982e87d78eadd554daecbddc840196f
SHA256b34456838249b4cf08848d0d91beb290f59d15079cad5a7afc3260e579669da9
SHA512f36ea78e8f3547714fadca3866fed138ff684194bcb379ec58a562259ffa076ea1129c43b9e2e19b7ab9df2a9a028ea4f31f8e96a8770ac0e9d9aba97ef0f9f0