Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/03/2024, 23:22
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-07_103a895ed4664a1f4bfea5fa029432ee_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-07_103a895ed4664a1f4bfea5fa029432ee_cryptolocker.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-07_103a895ed4664a1f4bfea5fa029432ee_cryptolocker.exe
-
Size
46KB
-
MD5
103a895ed4664a1f4bfea5fa029432ee
-
SHA1
285657de7db2174183d90db4bfed648ff0b24a77
-
SHA256
401bd2a1c66782ec8dfacf99b6f948965fd7dc148bfeb8a1a54ad83d5244217b
-
SHA512
bb4249f48e8ad26487d3a1f7347c26a9d5de9ac6ae7107bfbe5f9af0a108f6f9605eebdc3f2bf1979deeb4c8ca9dd30b94bbdd5dd56f8092607edbb8d591a1d3
-
SSDEEP
768:Kf1K2exg2kBwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZsBGGpebVIYLHA3Kxd:o1KhxqwtdgI2MyzNORQtOflIwoHNV2Xk
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
resource yara_rule behavioral1/files/0x000a000000014a94-10.dat CryptoLocker_rule2 -
Detection of Cryptolocker Samples 1 IoCs
resource yara_rule behavioral1/files/0x000a000000014a94-10.dat CryptoLocker_set1 -
Executes dropped EXE 1 IoCs
pid Process 2816 hurok.exe -
Loads dropped DLL 1 IoCs
pid Process 2804 2024-03-07_103a895ed4664a1f4bfea5fa029432ee_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2804 2024-03-07_103a895ed4664a1f4bfea5fa029432ee_cryptolocker.exe 2816 hurok.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2804 wrote to memory of 2816 2804 2024-03-07_103a895ed4664a1f4bfea5fa029432ee_cryptolocker.exe 28 PID 2804 wrote to memory of 2816 2804 2024-03-07_103a895ed4664a1f4bfea5fa029432ee_cryptolocker.exe 28 PID 2804 wrote to memory of 2816 2804 2024-03-07_103a895ed4664a1f4bfea5fa029432ee_cryptolocker.exe 28 PID 2804 wrote to memory of 2816 2804 2024-03-07_103a895ed4664a1f4bfea5fa029432ee_cryptolocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-07_103a895ed4664a1f4bfea5fa029432ee_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-07_103a895ed4664a1f4bfea5fa029432ee_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\hurok.exe"C:\Users\Admin\AppData\Local\Temp\hurok.exe"2⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2816
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD57833c63e8af20b31f3ed90d2e1aa45e5
SHA1344f7a0fdf17b159dcac02531707f9e2e60d403a
SHA256d54ce28656fa2e865a621da955658f3e0dbefdbc70509a23058cf8625f2d9c29
SHA512b5f60da57cf59dbcde826c1a7d545f281df32d06f1fc0dcf1a2bdc55510c8a4b17e504e66308a4ea848a9f424ed269d56b5ebad3894458a604f57c7251161a7a