Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09/04/2024, 03:27
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-09_0aa234801955fe89cb4312bb237fbec5_cryptolocker.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-04-09_0aa234801955fe89cb4312bb237fbec5_cryptolocker.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-09_0aa234801955fe89cb4312bb237fbec5_cryptolocker.exe
-
Size
45KB
-
MD5
0aa234801955fe89cb4312bb237fbec5
-
SHA1
ffea535af304da243d258b52da33e3b07de390ea
-
SHA256
fc803b107ad9dacaf781f5567c64c99142c2a4d44ee3bbc23d771447de6809ed
-
SHA512
814d702e7a889a4a8f592dd5f28cd079365a2828146cac17c74cadbeedf9b3a46d2e8a45d148249e61d30df4dcb93ea331d77bd73b4db8c5fac354a909caf854
-
SSDEEP
768:qmOKYQDf5XdrDmjr5tOOtEvwDpjAajFEitQbDmoSQCVUBJUkQqAHBIG05W2MoLn:qmbhXDmjr5MOtEvwDpj5cDtKkQZQ9
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
resource yara_rule behavioral2/memory/4916-0-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_rule2 behavioral2/files/0x0008000000023251-13.dat CryptoLocker_rule2 behavioral2/memory/4916-25-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_rule2 behavioral2/memory/1764-26-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_rule2 -
Detection of Cryptolocker Samples 2 IoCs
resource yara_rule behavioral2/memory/4916-25-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_set1 behavioral2/memory/1764-26-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_set1 -
UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral2/memory/4916-0-0x0000000000500000-0x0000000000510000-memory.dmp UPX behavioral2/files/0x0008000000023251-13.dat UPX behavioral2/memory/4916-25-0x0000000000500000-0x0000000000510000-memory.dmp UPX behavioral2/memory/1764-26-0x0000000000500000-0x0000000000510000-memory.dmp UPX -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 2024-04-09_0aa234801955fe89cb4312bb237fbec5_cryptolocker.exe -
Executes dropped EXE 1 IoCs
pid Process 1764 asih.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4916 wrote to memory of 1764 4916 2024-04-09_0aa234801955fe89cb4312bb237fbec5_cryptolocker.exe 96 PID 4916 wrote to memory of 1764 4916 2024-04-09_0aa234801955fe89cb4312bb237fbec5_cryptolocker.exe 96 PID 4916 wrote to memory of 1764 4916 2024-04-09_0aa234801955fe89cb4312bb237fbec5_cryptolocker.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-09_0aa234801955fe89cb4312bb237fbec5_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-09_0aa234801955fe89cb4312bb237fbec5_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
PID:1764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2756 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:81⤵PID:1880
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD57ac0aedf06b1ec68872b7dbe8799affa
SHA1da7b7f43660e53ae3bb5d72997d6230e8288b380
SHA2566082c2e7358f3628ee5ae6e5d5e234340ed2d2a0a1cc38b780266e1ba8667b56
SHA5128168d41a9f13bb65cf6211c01342d7c27da1a00011b156eebf618d7364cd5371a3ecb6c72dfb26fd5c09b3d8bd484da71b8789115718a03372d57fbce4235139