Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
27/03/2024, 10:41
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-27_be153d50e8f25fba9badfcc901abf86c_cryptolocker.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-03-27_be153d50e8f25fba9badfcc901abf86c_cryptolocker.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-27_be153d50e8f25fba9badfcc901abf86c_cryptolocker.exe
-
Size
44KB
-
MD5
be153d50e8f25fba9badfcc901abf86c
-
SHA1
027ee8e08c9eef78d46982dd48718b47bd066dde
-
SHA256
c907b13acd66e383bcc1b5922348bdcacd3bdd77f821f9e306458a72af670c1f
-
SHA512
4c858cb9fe61f7142cce99f4e7da1cb3c3d299680264a0f92028a5e1a29306f242a480264d035f352abd2426e9f8ee22bcc7f31c2c2e7b82c9d79fcb277b455d
-
SSDEEP
768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpj/MLam5aFr7YOzzfm0Exm:V6QFElP6n+gMQMOtEvwDpjyaYaFAh8
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
resource yara_rule behavioral1/files/0x0009000000014120-10.dat CryptoLocker_rule2 -
Detection of Cryptolocker Samples 1 IoCs
resource yara_rule behavioral1/files/0x0009000000014120-10.dat CryptoLocker_set1 -
Executes dropped EXE 1 IoCs
pid Process 3000 asih.exe -
Loads dropped DLL 1 IoCs
pid Process 2380 2024-03-27_be153d50e8f25fba9badfcc901abf86c_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2380 wrote to memory of 3000 2380 2024-03-27_be153d50e8f25fba9badfcc901abf86c_cryptolocker.exe 28 PID 2380 wrote to memory of 3000 2380 2024-03-27_be153d50e8f25fba9badfcc901abf86c_cryptolocker.exe 28 PID 2380 wrote to memory of 3000 2380 2024-03-27_be153d50e8f25fba9badfcc901abf86c_cryptolocker.exe 28 PID 2380 wrote to memory of 3000 2380 2024-03-27_be153d50e8f25fba9badfcc901abf86c_cryptolocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-27_be153d50e8f25fba9badfcc901abf86c_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-27_be153d50e8f25fba9badfcc901abf86c_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
PID:3000
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44KB
MD55bef5b16cb9ddbd5f64935330453b69f
SHA181444723cae2a25de262c6a74e8c44c4e7ced945
SHA256fa51383f4d1fca6e2aa60f44a02a2c1d5f561a8810def7f0e30cbe5664ac537e
SHA512d529428e03164a20afed3b0470d2b2b5dd2466ad9fcef641f6f8801422bbe3bb884e69be1a0729147cf79818ac8e9ea2923663e5172cb6747e3f9ce06f8442e0