Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
23/02/2024, 07:43
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-23_948e154fe35275569e40b95b10b3b5b8_cryptolocker.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-02-23_948e154fe35275569e40b95b10b3b5b8_cryptolocker.exe
Resource
win10v2004-20240221-en
General
-
Target
2024-02-23_948e154fe35275569e40b95b10b3b5b8_cryptolocker.exe
-
Size
38KB
-
MD5
948e154fe35275569e40b95b10b3b5b8
-
SHA1
33030bf79596579e3861084a2440bc0705b3e1ad
-
SHA256
6f3c3e58647a3d22b76200e5455860af444ad0700336eddc855a7e2ae0d2fc6d
-
SHA512
a5be72f41becd8c09d7161984dfcf2d401bd00d1b6d6fd6ae9525b9d44e33b8763b2ebea8eeb504cf8cf3c325dbacda88b2204c0904ea789609012b5750e2893
-
SSDEEP
768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBVaD3TP7DFHu8K7:X6QFElP6n+gJQMOtEvwDpjBmzDkz7
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
resource yara_rule behavioral2/files/0x0007000000023218-12.dat CryptoLocker_rule2 -
Detection of Cryptolocker Samples 1 IoCs
resource yara_rule behavioral2/files/0x0007000000023218-12.dat CryptoLocker_set1 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000\Control Panel\International\Geo\Nation 2024-02-23_948e154fe35275569e40b95b10b3b5b8_cryptolocker.exe -
Executes dropped EXE 1 IoCs
pid Process 2292 asih.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3872 wrote to memory of 2292 3872 2024-02-23_948e154fe35275569e40b95b10b3b5b8_cryptolocker.exe 87 PID 3872 wrote to memory of 2292 3872 2024-02-23_948e154fe35275569e40b95b10b3b5b8_cryptolocker.exe 87 PID 3872 wrote to memory of 2292 3872 2024-02-23_948e154fe35275569e40b95b10b3b5b8_cryptolocker.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_948e154fe35275569e40b95b10b3b5b8_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-23_948e154fe35275569e40b95b10b3b5b8_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
PID:2292
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD522518f855acbc29f68773aca2d2b8d0f
SHA1172c96bec7b9cf27136732d64678feb4066be1a9
SHA2569e9a6fbdc0f4fe97fe02499a4e20caf9b8f169131f5ed28a705803d766119785
SHA5128cd22126d58b7391306f2b9e5d771a1d2ebebc31db9380b515f7ae4deca0d492fcadbf9ac872de589fbc136c1a2a71d5cb71c7bc26559369dc7f344a2f4a1a83