Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/04/2024, 03:25
Behavioral task
behavioral1
Sample
2024-04-11_127db1c95b865f60acd3c31541fe3f5d_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-11_127db1c95b865f60acd3c31541fe3f5d_cryptolocker.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-11_127db1c95b865f60acd3c31541fe3f5d_cryptolocker.exe
-
Size
84KB
-
MD5
127db1c95b865f60acd3c31541fe3f5d
-
SHA1
418a3a0c333c0f7d47f71238edc19e7057237581
-
SHA256
2e605f03af7eda9334758610937421ca7c54c8ad015a95847670f99dc2fcdbcf
-
SHA512
24b0fd0870f4e6984b474e101d3ef0cae07b99f52dccbd1a710571322ed1cf30a47b70f1af0ec110470c09c1761e81490a9991aa0d762e6dda4a7247ecfcbc88
-
SSDEEP
1536:T6QFElP6n+gxmddpMOtEvwDpjwaxTNUOT7vM5RQ:T6a+rdOOtEvwDpjNV
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
resource yara_rule behavioral1/memory/2044-0-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_rule2 behavioral1/files/0x000900000001224e-11.dat CryptoLocker_rule2 behavioral1/memory/2044-15-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_rule2 behavioral1/memory/2684-16-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_rule2 behavioral1/memory/2684-26-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_rule2 -
Detection of Cryptolocker Samples 5 IoCs
resource yara_rule behavioral1/memory/2044-0-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_set1 behavioral1/files/0x000900000001224e-11.dat CryptoLocker_set1 behavioral1/memory/2044-15-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_set1 behavioral1/memory/2684-16-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_set1 behavioral1/memory/2684-26-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_set1 -
UPX dump on OEP (original entry point) 5 IoCs
resource yara_rule behavioral1/memory/2044-0-0x0000000000500000-0x0000000000510000-memory.dmp UPX behavioral1/files/0x000900000001224e-11.dat UPX behavioral1/memory/2044-15-0x0000000000500000-0x0000000000510000-memory.dmp UPX behavioral1/memory/2684-16-0x0000000000500000-0x0000000000510000-memory.dmp UPX behavioral1/memory/2684-26-0x0000000000500000-0x0000000000510000-memory.dmp UPX -
Executes dropped EXE 1 IoCs
pid Process 2684 asih.exe -
Loads dropped DLL 1 IoCs
pid Process 2044 2024-04-11_127db1c95b865f60acd3c31541fe3f5d_cryptolocker.exe -
resource yara_rule behavioral1/memory/2044-0-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/files/0x000900000001224e-11.dat upx behavioral1/memory/2044-15-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/memory/2684-16-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/memory/2684-26-0x0000000000500000-0x0000000000510000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2044 wrote to memory of 2684 2044 2024-04-11_127db1c95b865f60acd3c31541fe3f5d_cryptolocker.exe 28 PID 2044 wrote to memory of 2684 2044 2024-04-11_127db1c95b865f60acd3c31541fe3f5d_cryptolocker.exe 28 PID 2044 wrote to memory of 2684 2044 2024-04-11_127db1c95b865f60acd3c31541fe3f5d_cryptolocker.exe 28 PID 2044 wrote to memory of 2684 2044 2024-04-11_127db1c95b865f60acd3c31541fe3f5d_cryptolocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-11_127db1c95b865f60acd3c31541fe3f5d_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-11_127db1c95b865f60acd3c31541fe3f5d_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
PID:2684
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84KB
MD5c8043483af1cf405d23588cfc0cba1e1
SHA17bb96a5af4f297b9c87a18354050ec12cbc5d33c
SHA256c64379b057e852a1376f82a25c2a28a53895f6528c95ed1aba0109c220934a9b
SHA5127023b382d514111d3522b1d99c64bc11fac87a288d47999c5ccddb12d49a51d53ff10c33e720cdef1001a96f69f2216e70823d16598db4914c06ab7374d77464