Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
23/02/2024, 21:01
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-23_fdd37eba78945d743b2d99c05771c878_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-02-23_fdd37eba78945d743b2d99c05771c878_cryptolocker.exe
Resource
win10v2004-20240221-en
General
-
Target
2024-02-23_fdd37eba78945d743b2d99c05771c878_cryptolocker.exe
-
Size
38KB
-
MD5
fdd37eba78945d743b2d99c05771c878
-
SHA1
d3f8aa296086aaaad77e7019fdd99e824cbc31b2
-
SHA256
04725c6c27392120e0f973fed104c049f6a07fa4ec5ca7836d7fc1323af42458
-
SHA512
ffe1fd6493e17f0d36c8cf790705a71b4ce241c0239a8d37d1b6f89e281994bb5c7112fccd8176b565b7d2c7e79b29ee2032a9470ceb21c4848f11498b5cb45f
-
SSDEEP
768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjLen7n+1:ZzFbxmLPWQMOtEvwDpjLeu
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
resource yara_rule behavioral2/files/0x00c300000001e848-13.dat CryptoLocker_rule2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2132103209-3755304320-2959162027-1000\Control Panel\International\Geo\Nation 2024-02-23_fdd37eba78945d743b2d99c05771c878_cryptolocker.exe -
Executes dropped EXE 1 IoCs
pid Process 2536 misid.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4092 wrote to memory of 2536 4092 2024-02-23_fdd37eba78945d743b2d99c05771c878_cryptolocker.exe 86 PID 4092 wrote to memory of 2536 4092 2024-02-23_fdd37eba78945d743b2d99c05771c878_cryptolocker.exe 86 PID 4092 wrote to memory of 2536 4092 2024-02-23_fdd37eba78945d743b2d99c05771c878_cryptolocker.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_fdd37eba78945d743b2d99c05771c878_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-23_fdd37eba78945d743b2d99c05771c878_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
PID:2536
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD56fc244d59795d60677deb2dc98d90903
SHA1a1230c768d43f56ac24eda04c9d6a4e56d497ce0
SHA256c31661d5fcfefda9c74131abfe741890541ad92061ed15abc951fda0e936c976
SHA51281527bf32e6d1db11c89ba944d368f8ee2e16cba845709791cba835cb36a2b8986a532c251012f8ea22038d8030a5f7ec525272b879cf144a8a428dcd161c12b