Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16/04/2024, 04:56
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-16_8a4646a8b0da449de75206b2c79141da_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-16_8a4646a8b0da449de75206b2c79141da_cryptolocker.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-16_8a4646a8b0da449de75206b2c79141da_cryptolocker.exe
-
Size
31KB
-
MD5
8a4646a8b0da449de75206b2c79141da
-
SHA1
6f404c317c7f28858b5585885186b83a48c4a4ea
-
SHA256
f136d448d9294c8a41a653652f044a85ee4d6a188623445d0783367a0495d6c6
-
SHA512
d045794b3ff17046e77628743daa2362eedf34d1493cdb6d9eec6daa3c06c38f3211dd0d95e9c522623c35a9a84cc39aee4afd3233622f4a9e7d4dadaeccc496
-
SSDEEP
384:bG74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUGTGH:bG74zYcgT/Ekd0ryfjC
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
resource yara_rule behavioral1/memory/2156-0-0x0000000008000000-0x000000000800A000-memory.dmp CryptoLocker_rule2 behavioral1/files/0x0008000000012254-11.dat CryptoLocker_rule2 behavioral1/memory/2156-15-0x0000000008000000-0x000000000800A000-memory.dmp CryptoLocker_rule2 behavioral1/memory/2516-16-0x0000000008000000-0x000000000800A000-memory.dmp CryptoLocker_rule2 behavioral1/memory/2516-26-0x0000000008000000-0x000000000800A000-memory.dmp CryptoLocker_rule2 -
Executes dropped EXE 1 IoCs
pid Process 2516 hasfj.exe -
Loads dropped DLL 1 IoCs
pid Process 2156 2024-04-16_8a4646a8b0da449de75206b2c79141da_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2156 wrote to memory of 2516 2156 2024-04-16_8a4646a8b0da449de75206b2c79141da_cryptolocker.exe 28 PID 2156 wrote to memory of 2516 2156 2024-04-16_8a4646a8b0da449de75206b2c79141da_cryptolocker.exe 28 PID 2156 wrote to memory of 2516 2156 2024-04-16_8a4646a8b0da449de75206b2c79141da_cryptolocker.exe 28 PID 2156 wrote to memory of 2516 2156 2024-04-16_8a4646a8b0da449de75206b2c79141da_cryptolocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-16_8a4646a8b0da449de75206b2c79141da_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-16_8a4646a8b0da449de75206b2c79141da_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\hasfj.exe"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"2⤵
- Executes dropped EXE
PID:2516
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31KB
MD5561a8a52869d62647d8888286be92f2d
SHA1b1c303e1f29c924d018918e6003cebe64408688e
SHA256921d74601ce2a00ca2d200648b6fe334442a4ea2e566000e7ac3699214a12859
SHA512bea14a1f4ebf460c3726062e5865a2be1321f477e281b4daf6ba6dc506d2e4458acd78485ca539a4ae9752b291c6da62fd19fdea4f57d477511b406904e68cfc