Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/04/2024, 16:34
Behavioral task
behavioral1
Sample
2024-04-10_3769be4f198e9b264591b945b4d87be5_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-10_3769be4f198e9b264591b945b4d87be5_cryptolocker.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-10_3769be4f198e9b264591b945b4d87be5_cryptolocker.exe
-
Size
117KB
-
MD5
3769be4f198e9b264591b945b4d87be5
-
SHA1
7edf4eb2cfe39d72ab294387cbf1d5c185e8e948
-
SHA256
ca049f65bd35375f5219be8d64ffe83ec8560e921631b30c032388e057460925
-
SHA512
7deecaf5a2512c7e7e31308810846a8b5f5b262d373d1cf56abae33324a1db97e5e3dc3581b6a3c183909bceb4ced10a6f2b22da997c28bfdf48951dedb4f33d
-
SSDEEP
1536:z6QFElP6n+gKmddpMOtEvwDpj3GYQbN/PKwNgpYICSC:z6a+CdOOtEvwDpjczl
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
resource yara_rule behavioral1/memory/3068-0-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_rule2 behavioral1/files/0x000c000000012329-11.dat CryptoLocker_rule2 behavioral1/memory/3068-15-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_rule2 behavioral1/memory/1988-17-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_rule2 behavioral1/memory/1988-26-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_rule2 -
Detection of Cryptolocker Samples 5 IoCs
resource yara_rule behavioral1/memory/3068-0-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_set1 behavioral1/files/0x000c000000012329-11.dat CryptoLocker_set1 behavioral1/memory/3068-15-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_set1 behavioral1/memory/1988-17-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_set1 behavioral1/memory/1988-26-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_set1 -
UPX dump on OEP (original entry point) 5 IoCs
resource yara_rule behavioral1/memory/3068-0-0x0000000000500000-0x0000000000510000-memory.dmp UPX behavioral1/files/0x000c000000012329-11.dat UPX behavioral1/memory/3068-15-0x0000000000500000-0x0000000000510000-memory.dmp UPX behavioral1/memory/1988-17-0x0000000000500000-0x0000000000510000-memory.dmp UPX behavioral1/memory/1988-26-0x0000000000500000-0x0000000000510000-memory.dmp UPX -
Executes dropped EXE 1 IoCs
pid Process 1988 asih.exe -
Loads dropped DLL 1 IoCs
pid Process 3068 2024-04-10_3769be4f198e9b264591b945b4d87be5_cryptolocker.exe -
resource yara_rule behavioral1/memory/3068-0-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/files/0x000c000000012329-11.dat upx behavioral1/memory/3068-15-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/memory/1988-17-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/memory/1988-26-0x0000000000500000-0x0000000000510000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3068 wrote to memory of 1988 3068 2024-04-10_3769be4f198e9b264591b945b4d87be5_cryptolocker.exe 28 PID 3068 wrote to memory of 1988 3068 2024-04-10_3769be4f198e9b264591b945b4d87be5_cryptolocker.exe 28 PID 3068 wrote to memory of 1988 3068 2024-04-10_3769be4f198e9b264591b945b4d87be5_cryptolocker.exe 28 PID 3068 wrote to memory of 1988 3068 2024-04-10_3769be4f198e9b264591b945b4d87be5_cryptolocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-10_3769be4f198e9b264591b945b4d87be5_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-10_3769be4f198e9b264591b945b4d87be5_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
PID:1988
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
117KB
MD5c891f061b8964639e74ef73e4289e2ed
SHA18077a0b142b28541a23ea6ed7bbb1f1489d92c41
SHA2565f23308cd65cbb4799a65754d9e9e04d5e3fe0125020878b946f739741274bbe
SHA512281d1d37422f382ecebf531414dfa3c195def4103a874c9191cc91f9f10d1088ef0c2d9ce2ba3044d5c4541123a7ac1ffe2ba5f6f0a4d5806c035edabb532a6b