Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/02/2024, 06:39
Behavioral task
behavioral1
Sample
2024-02-28_a86b58c09be4602ef473448e023bc14f_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-02-28_a86b58c09be4602ef473448e023bc14f_cryptolocker.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-02-28_a86b58c09be4602ef473448e023bc14f_cryptolocker.exe
-
Size
102KB
-
MD5
a86b58c09be4602ef473448e023bc14f
-
SHA1
b6252bcca789422e827b8afa735d23d3ad8b7def
-
SHA256
6178ddb132f7c7962304a445969dad28d74f2e11ac166133e4206343fd7fcb9e
-
SHA512
1068b3dc3515d7808db1af940ff2f25652651f9423299e2df20f83c1f5163e80916560680b5655dbb0db652e5266cd9fd9778e7871aeefd7f56ea870c8a1ef2a
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgpwqWsviy6r:AnBdOOtEvwDpj6z3
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
resource yara_rule behavioral1/memory/1204-0-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_rule2 behavioral1/files/0x000a000000012266-11.dat CryptoLocker_rule2 behavioral1/memory/1204-15-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_rule2 behavioral1/memory/2960-16-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_rule2 behavioral1/memory/2960-26-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_rule2 -
Detection of Cryptolocker Samples 5 IoCs
resource yara_rule behavioral1/memory/1204-0-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_set1 behavioral1/files/0x000a000000012266-11.dat CryptoLocker_set1 behavioral1/memory/1204-15-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_set1 behavioral1/memory/2960-16-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_set1 behavioral1/memory/2960-26-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_set1 -
UPX dump on OEP (original entry point) 5 IoCs
resource yara_rule behavioral1/memory/1204-0-0x0000000000500000-0x000000000050F000-memory.dmp UPX behavioral1/files/0x000a000000012266-11.dat UPX behavioral1/memory/1204-15-0x0000000000500000-0x000000000050F000-memory.dmp UPX behavioral1/memory/2960-16-0x0000000000500000-0x000000000050F000-memory.dmp UPX behavioral1/memory/2960-26-0x0000000000500000-0x000000000050F000-memory.dmp UPX -
Executes dropped EXE 1 IoCs
pid Process 2960 asih.exe -
Loads dropped DLL 1 IoCs
pid Process 1204 2024-02-28_a86b58c09be4602ef473448e023bc14f_cryptolocker.exe -
resource yara_rule behavioral1/memory/1204-0-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/files/0x000a000000012266-11.dat upx behavioral1/memory/1204-15-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/2960-16-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/2960-26-0x0000000000500000-0x000000000050F000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1204 wrote to memory of 2960 1204 2024-02-28_a86b58c09be4602ef473448e023bc14f_cryptolocker.exe 28 PID 1204 wrote to memory of 2960 1204 2024-02-28_a86b58c09be4602ef473448e023bc14f_cryptolocker.exe 28 PID 1204 wrote to memory of 2960 1204 2024-02-28_a86b58c09be4602ef473448e023bc14f_cryptolocker.exe 28 PID 1204 wrote to memory of 2960 1204 2024-02-28_a86b58c09be4602ef473448e023bc14f_cryptolocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-28_a86b58c09be4602ef473448e023bc14f_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-28_a86b58c09be4602ef473448e023bc14f_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
PID:2960
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
102KB
MD53fe42544b2427884e6e427be20cb2b5a
SHA158ceea1a25a42b1fd9466999bef10207b51e043c
SHA25692a59496d627c158c4b4c0bdae9355611c165e95c5f9b5a28b084372cda6c5d0
SHA5123ec795cebc80a959c43cb5af178abedf439619179aa981f2944005dc2d21bfb4aedb7bf989dc6eabd66201d54eb279ec50430a275705b03505e228b806a50d35