Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
10/03/2024, 02:50
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-10_d51e977f3f49009d2b9d02921835b843_cryptolocker.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-03-10_d51e977f3f49009d2b9d02921835b843_cryptolocker.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-10_d51e977f3f49009d2b9d02921835b843_cryptolocker.exe
-
Size
38KB
-
MD5
d51e977f3f49009d2b9d02921835b843
-
SHA1
20fabc351c0c01e4edbc71e49439862fe4ab7e7a
-
SHA256
b7e0348ffb44bbc57accd50388b0dbbeebe5be9d1128ffcc359054b57d8781da
-
SHA512
2c40886fa51639d6bfe93a9ebf8a0774bae1aca3b501e2fab4e1dac9b858a5b7da644cdd3cd83f300ac865ea57039aa5da10eaf6d52672df9239595999dcfaff
-
SSDEEP
768:TS5nQJ24LR7tOOtEvwDpjGqPhqlcnvP7DMr:m5nkFNMOtEvwDpjG8hP7DMr
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
resource yara_rule behavioral1/memory/2364-0-0x0000000000500000-0x000000000050E000-memory.dmp CryptoLocker_rule2 behavioral1/files/0x0009000000014120-11.dat CryptoLocker_rule2 behavioral1/memory/2364-15-0x0000000001CF0000-0x0000000001CFE000-memory.dmp CryptoLocker_rule2 behavioral1/memory/2364-14-0x0000000000500000-0x000000000050E000-memory.dmp CryptoLocker_rule2 behavioral1/memory/2380-17-0x0000000000500000-0x000000000050E000-memory.dmp CryptoLocker_rule2 behavioral1/memory/2380-26-0x0000000000500000-0x000000000050E000-memory.dmp CryptoLocker_rule2 -
Detection of Cryptolocker Samples 3 IoCs
resource yara_rule behavioral1/memory/2364-14-0x0000000000500000-0x000000000050E000-memory.dmp CryptoLocker_set1 behavioral1/memory/2380-17-0x0000000000500000-0x000000000050E000-memory.dmp CryptoLocker_set1 behavioral1/memory/2380-26-0x0000000000500000-0x000000000050E000-memory.dmp CryptoLocker_set1 -
Detects executables built or packed with MPress PE compressor 5 IoCs
resource yara_rule behavioral1/memory/2364-0-0x0000000000500000-0x000000000050E000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/files/0x0009000000014120-11.dat INDICATOR_EXE_Packed_MPress behavioral1/memory/2364-14-0x0000000000500000-0x000000000050E000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/2380-17-0x0000000000500000-0x000000000050E000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/2380-26-0x0000000000500000-0x000000000050E000-memory.dmp INDICATOR_EXE_Packed_MPress -
Executes dropped EXE 1 IoCs
pid Process 2380 misid.exe -
Loads dropped DLL 1 IoCs
pid Process 2364 2024-03-10_d51e977f3f49009d2b9d02921835b843_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2364 wrote to memory of 2380 2364 2024-03-10_d51e977f3f49009d2b9d02921835b843_cryptolocker.exe 28 PID 2364 wrote to memory of 2380 2364 2024-03-10_d51e977f3f49009d2b9d02921835b843_cryptolocker.exe 28 PID 2364 wrote to memory of 2380 2364 2024-03-10_d51e977f3f49009d2b9d02921835b843_cryptolocker.exe 28 PID 2364 wrote to memory of 2380 2364 2024-03-10_d51e977f3f49009d2b9d02921835b843_cryptolocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-10_d51e977f3f49009d2b9d02921835b843_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-10_d51e977f3f49009d2b9d02921835b843_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
PID:2380
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD5cdfbb92b6379923239fd91c7d488edc0
SHA159f854bb046525e866aa7067cb404bf63420b4fc
SHA256f687f79caa0341eb89020c6f524476f2575fd4f0f5351342ea83d1035f058f5f
SHA512d5988f5f328fa0b35ff2f77655e0c3ae99e3666541285a620a913bd70f21b47d0ddf7da89ae461bd75e03f2864afb27ebe286ea3a80cb4ea0f5d85bbdcae6853