Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28/03/2024, 15:31
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-28_95959b13a1354783ab9accb4235f14c7_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-28_95959b13a1354783ab9accb4235f14c7_cryptolocker.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-28_95959b13a1354783ab9accb4235f14c7_cryptolocker.exe
-
Size
41KB
-
MD5
95959b13a1354783ab9accb4235f14c7
-
SHA1
f858f0a8f161f6ff806d07d468995b7b30ff62ef
-
SHA256
9b00d087a27c3ea6e047858aec3b6ad9cb2a580151a0921f3c06c7123c3ca9f1
-
SHA512
79aa54c56341a6b637c38bfeaa347b05bd9867b2a0a941611139257e1a6d5b4b1f782e88ec62909ad2b979f4183497f5bd76cc0cfa5c98954fd45e63d9f8a3ec
-
SSDEEP
768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjLenQL3bTyjL4P:ZzFbxmLPWQMOtEvwDpjLeU34Y
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
resource yara_rule behavioral2/files/0x00090000000226e5-13.dat CryptoLocker_rule2 -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation 2024-03-28_95959b13a1354783ab9accb4235f14c7_cryptolocker.exe Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation misid.exe -
Executes dropped EXE 1 IoCs
pid Process 996 misid.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4104 wrote to memory of 996 4104 2024-03-28_95959b13a1354783ab9accb4235f14c7_cryptolocker.exe 87 PID 4104 wrote to memory of 996 4104 2024-03-28_95959b13a1354783ab9accb4235f14c7_cryptolocker.exe 87 PID 4104 wrote to memory of 996 4104 2024-03-28_95959b13a1354783ab9accb4235f14c7_cryptolocker.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_95959b13a1354783ab9accb4235f14c7_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-28_95959b13a1354783ab9accb4235f14c7_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
PID:996
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD5044e5a094b4440c72247e3656cc97d82
SHA18b6ba8e77868bcbd4346a61d9687d64533c4affe
SHA256fb41d8f58e348a62a82eb9eeaeef1e596008bff911b08a30c43ba7935bf8955a
SHA512d78444fdc88f91cd82ef2dd5a155d9dca416c193623c2db00bc57634be1590e0f611f6bac0b5575d027b11f00b09b71e23e2d50a57123af9b7144f9c7414e1d7