Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/03/2024, 21:32
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-05_41e1899ad2339a6b7aab49214515421d_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-05_41e1899ad2339a6b7aab49214515421d_cryptolocker.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-05_41e1899ad2339a6b7aab49214515421d_cryptolocker.exe
-
Size
53KB
-
MD5
41e1899ad2339a6b7aab49214515421d
-
SHA1
d8317f4995ff72be638c5d32ef81d700ac6b5f06
-
SHA256
553ae1b418199f5c21ee4c7533043de2add0edad3ed271dcfbb137cb0cf35e21
-
SHA512
3a8459bfff195606bb2da0da5b3dce109eafdaa67fe667e279bb217097b09f88186bbfbeaa1cc805600282c211bc2c9c11eb70001168c2088ce5cf8a65a04214
-
SSDEEP
768:bIDOw9UiaCHfjnE0Sfa7ilR0p9u6p4ICNBCXK9XbTbmhTyms:bIDOw9a0DwitDZzcT2s
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
resource yara_rule behavioral1/files/0x000a00000001418d-10.dat CryptoLocker_rule2 -
Executes dropped EXE 1 IoCs
pid Process 2904 lossy.exe -
Loads dropped DLL 1 IoCs
pid Process 2912 2024-03-05_41e1899ad2339a6b7aab49214515421d_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2912 wrote to memory of 2904 2912 2024-03-05_41e1899ad2339a6b7aab49214515421d_cryptolocker.exe 28 PID 2912 wrote to memory of 2904 2912 2024-03-05_41e1899ad2339a6b7aab49214515421d_cryptolocker.exe 28 PID 2912 wrote to memory of 2904 2912 2024-03-05_41e1899ad2339a6b7aab49214515421d_cryptolocker.exe 28 PID 2912 wrote to memory of 2904 2912 2024-03-05_41e1899ad2339a6b7aab49214515421d_cryptolocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-05_41e1899ad2339a6b7aab49214515421d_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-05_41e1899ad2339a6b7aab49214515421d_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\lossy.exe"C:\Users\Admin\AppData\Local\Temp\lossy.exe"2⤵
- Executes dropped EXE
PID:2904
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54KB
MD500de1b62308bc5b403bdb92213aa531b
SHA1a1eb6534c275f4782195ec76bac27ff3e05ab373
SHA2566d2409b6b4b1ee2ea2b6bf12b53c1f92409ec4ba7af44e7621a7cf789c274519
SHA512c136900e49fbb97b61bb582f2ea654d6cdce6b36007261803a47e6fd956b7fcfe2768dcfbd840a7e3580ef0b1232b5d73f8a7d24bf7438d480aaa987bf0f6c78