Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/04/2024, 11:41
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-15_5c46af4640394a086fab8153edc0e5a9_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-15_5c46af4640394a086fab8153edc0e5a9_cryptolocker.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-15_5c46af4640394a086fab8153edc0e5a9_cryptolocker.exe
-
Size
30KB
-
MD5
5c46af4640394a086fab8153edc0e5a9
-
SHA1
a7eb821436b03767b6201d19a2412871e6723c83
-
SHA256
0f3af209637c197bd42a75032936773f3ef6b67f699ded4779dde25131d6724a
-
SHA512
4c5e66b719b0558de23ff08aa10ff2ca25df739423f8ebbbb57600a4c81017078a33eafa8062960e23e9b126429d348e9ab890de1b5c0cf8305ca716d0f40fc3
-
SSDEEP
384:bG74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUGTGB:bG74zYcgT/Ekd0ryfjo
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
resource yara_rule behavioral1/memory/2752-0-0x0000000008000000-0x000000000800A000-memory.dmp CryptoLocker_rule2 behavioral1/files/0x000a0000000122b8-11.dat CryptoLocker_rule2 behavioral1/memory/2752-15-0x0000000008000000-0x000000000800A000-memory.dmp CryptoLocker_rule2 behavioral1/memory/1728-16-0x0000000008000000-0x000000000800A000-memory.dmp CryptoLocker_rule2 behavioral1/memory/1728-26-0x0000000008000000-0x000000000800A000-memory.dmp CryptoLocker_rule2 -
Executes dropped EXE 1 IoCs
pid Process 1728 hasfj.exe -
Loads dropped DLL 1 IoCs
pid Process 2752 2024-04-15_5c46af4640394a086fab8153edc0e5a9_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2752 wrote to memory of 1728 2752 2024-04-15_5c46af4640394a086fab8153edc0e5a9_cryptolocker.exe 28 PID 2752 wrote to memory of 1728 2752 2024-04-15_5c46af4640394a086fab8153edc0e5a9_cryptolocker.exe 28 PID 2752 wrote to memory of 1728 2752 2024-04-15_5c46af4640394a086fab8153edc0e5a9_cryptolocker.exe 28 PID 2752 wrote to memory of 1728 2752 2024-04-15_5c46af4640394a086fab8153edc0e5a9_cryptolocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-15_5c46af4640394a086fab8153edc0e5a9_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-15_5c46af4640394a086fab8153edc0e5a9_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\hasfj.exe"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"2⤵
- Executes dropped EXE
PID:1728
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
30KB
MD5bbb6ab80a524a164ff81555c441e97af
SHA1296f033ae0a944e110e0f4d9b06d96b2b9b8ac4f
SHA2560e761df982d2e65573f3d1cd9b6910c7d8ec8cb5c91d273b3ed79b67a14e4a6a
SHA512d682a0a42dd1926c62233c4e3ec1f25f2b06cc4f15449af30d3441cb7de46e72ba7aaeaf1f3126d21adcdde5e737f637efc3d69cbb59f0e7cfc337336e9e72b2