Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28/02/2024, 20:56
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-28_eaaf13324f6fa44584bf34aa45382679_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-02-28_eaaf13324f6fa44584bf34aa45382679_cryptolocker.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-02-28_eaaf13324f6fa44584bf34aa45382679_cryptolocker.exe
-
Size
48KB
-
MD5
eaaf13324f6fa44584bf34aa45382679
-
SHA1
633aa27373fb2bb949641af7c4f15b3354d93882
-
SHA256
739e7b7f6b2d87c60b4bc132c0d562191dd2d2c808a37bf65cfcaf4f17458dcc
-
SHA512
12c9fa2b4dd0014faf087ee4070980d34ceec9154bb51a769f3ab678081e8962c8c0df24aebeef4936bd3cfd441cd0590da14548f57bf78065e00b6e2f0c0b78
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWE6BLbjG9RzhwaNm:xj+VGMOtEvwDpjy+TQ
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
resource yara_rule behavioral2/memory/2388-0-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_rule2 behavioral2/files/0x000700000001ebc7-13.dat CryptoLocker_rule2 behavioral2/memory/2388-17-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_rule2 behavioral2/memory/3432-54-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_rule2 -
Detection of Cryptolocker Samples 4 IoCs
resource yara_rule behavioral2/memory/2388-0-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_set1 behavioral2/files/0x000700000001ebc7-13.dat CryptoLocker_set1 behavioral2/memory/2388-17-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_set1 behavioral2/memory/3432-54-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_set1 -
Detects executables built or packed with MPress PE compressor 4 IoCs
resource yara_rule behavioral2/memory/2388-0-0x0000000000500000-0x0000000000510000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/files/0x000700000001ebc7-13.dat INDICATOR_EXE_Packed_MPress behavioral2/memory/2388-17-0x0000000000500000-0x0000000000510000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/3432-54-0x0000000000500000-0x0000000000510000-memory.dmp INDICATOR_EXE_Packed_MPress -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation misid.exe Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation 2024-02-28_eaaf13324f6fa44584bf34aa45382679_cryptolocker.exe -
Executes dropped EXE 1 IoCs
pid Process 3432 misid.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2388 wrote to memory of 3432 2388 2024-02-28_eaaf13324f6fa44584bf34aa45382679_cryptolocker.exe 87 PID 2388 wrote to memory of 3432 2388 2024-02-28_eaaf13324f6fa44584bf34aa45382679_cryptolocker.exe 87 PID 2388 wrote to memory of 3432 2388 2024-02-28_eaaf13324f6fa44584bf34aa45382679_cryptolocker.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-28_eaaf13324f6fa44584bf34aa45382679_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-28_eaaf13324f6fa44584bf34aa45382679_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
PID:3432
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD5d5a61fc3afd273e7d130cfada7f9598a
SHA1928190a4e662964dad4bfd51fc39b185a3958efa
SHA256aa050166d6cd3c6d3fba69bd847cc389e9e227ebfb2c5693485963840bb9fbc8
SHA5120904b11affa04e27f098204211aa6bdad6f23e79f282cb0cc60f683e10bfcd162a57f4e93438e1a8d91d20cd17caaa6fd55d4a366e4ec9316a85df1d51342d1c