Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23/02/2024, 02:23
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-23_1a8da4bf2decb881717e0ad5dbb26ef8_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-02-23_1a8da4bf2decb881717e0ad5dbb26ef8_cryptolocker.exe
Resource
win10v2004-20240221-en
General
-
Target
2024-02-23_1a8da4bf2decb881717e0ad5dbb26ef8_cryptolocker.exe
-
Size
68KB
-
MD5
1a8da4bf2decb881717e0ad5dbb26ef8
-
SHA1
2a79c30b6430ad10cc36d9bcad22b399e978808c
-
SHA256
7463739c1f8a76bb17ccdd3545c039fbeb1bf6206226d1785ec6da6f6b8ad6c7
-
SHA512
95c1bc82b2d7ee313c737a791d825f80df188e82d8e2f03e027cd728b3774137aa400dea33f38da63bf6787a61474f628ead11f470e396c9e16a09bceda23847
-
SSDEEP
1536:Dk/xY0sllyGQMOtEvwDpjwycDtKkQZQRKb61vSbgZ3QzNKU8:DW60sllyWOtEvwDpjwF85O
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
resource yara_rule behavioral1/memory/2976-0-0x0000000000500000-0x000000000050B000-memory.dmp CryptoLocker_rule2 behavioral1/files/0x0008000000012249-11.dat CryptoLocker_rule2 behavioral1/memory/2976-15-0x0000000000500000-0x000000000050B000-memory.dmp CryptoLocker_rule2 behavioral1/memory/2852-17-0x0000000000500000-0x000000000050B000-memory.dmp CryptoLocker_rule2 -
Detection of Cryptolocker Samples 4 IoCs
resource yara_rule behavioral1/memory/2976-0-0x0000000000500000-0x000000000050B000-memory.dmp CryptoLocker_set1 behavioral1/files/0x0008000000012249-11.dat CryptoLocker_set1 behavioral1/memory/2976-15-0x0000000000500000-0x000000000050B000-memory.dmp CryptoLocker_set1 behavioral1/memory/2852-17-0x0000000000500000-0x000000000050B000-memory.dmp CryptoLocker_set1 -
Executes dropped EXE 1 IoCs
pid Process 2852 asih.exe -
Loads dropped DLL 1 IoCs
pid Process 2976 2024-02-23_1a8da4bf2decb881717e0ad5dbb26ef8_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2976 wrote to memory of 2852 2976 2024-02-23_1a8da4bf2decb881717e0ad5dbb26ef8_cryptolocker.exe 28 PID 2976 wrote to memory of 2852 2976 2024-02-23_1a8da4bf2decb881717e0ad5dbb26ef8_cryptolocker.exe 28 PID 2976 wrote to memory of 2852 2976 2024-02-23_1a8da4bf2decb881717e0ad5dbb26ef8_cryptolocker.exe 28 PID 2976 wrote to memory of 2852 2976 2024-02-23_1a8da4bf2decb881717e0ad5dbb26ef8_cryptolocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_1a8da4bf2decb881717e0ad5dbb26ef8_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-23_1a8da4bf2decb881717e0ad5dbb26ef8_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
PID:2852
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD574779734561ee86159bb43288d777952
SHA1bd0d5e0d3ef4b7116d7736680f475aeb8fb030e2
SHA2561811961c358ebbc9923a9932d2dc10335be698a27a247f4af32f8cf1ede5c156
SHA512f78313b62eb7dc066205706ccf947f146cf3c68965ee86d340da55145c4a0f5f58066e79aa6fe7a664043d2047cf0c0582107774e367493d991bf94bcb529c57