Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
171s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18/04/2024, 14:28 UTC
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-18_a8d868015f7e24b2465e0965b9813c7e_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-18_a8d868015f7e24b2465e0965b9813c7e_cryptolocker.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-18_a8d868015f7e24b2465e0965b9813c7e_cryptolocker.exe
-
Size
389KB
-
MD5
a8d868015f7e24b2465e0965b9813c7e
-
SHA1
15177c110117f13c6d4511a19afd2a8560096fcd
-
SHA256
599d0f1f85d606dac4d4c98efcc3e9f0162c0d53321143dfaab07fc2fb0454b4
-
SHA512
80dcf56b2599d9f89365a3746dbccd26687a1797396c240a89dc720fa7e547c3c831fd7b3e9425e71bc0d3f185164bff3a45b54abbdf787db8c79d52561f43c2
-
SSDEEP
6144:nnOsaQgAOjvrZFODJjBz3j1jTqQy6v2GGnugOtihzXb:nnOflT/ZFIjBz3xjTxynGUOUhXb
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
resource yara_rule behavioral1/files/0x000b000000012267-10.dat CryptoLocker_rule2 -
Executes dropped EXE 1 IoCs
pid Process 2968 hasfj.exe -
Loads dropped DLL 1 IoCs
pid Process 3008 2024-04-18_a8d868015f7e24b2465e0965b9813c7e_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3008 wrote to memory of 2968 3008 2024-04-18_a8d868015f7e24b2465e0965b9813c7e_cryptolocker.exe 28 PID 3008 wrote to memory of 2968 3008 2024-04-18_a8d868015f7e24b2465e0965b9813c7e_cryptolocker.exe 28 PID 3008 wrote to memory of 2968 3008 2024-04-18_a8d868015f7e24b2465e0965b9813c7e_cryptolocker.exe 28 PID 3008 wrote to memory of 2968 3008 2024-04-18_a8d868015f7e24b2465e0965b9813c7e_cryptolocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-18_a8d868015f7e24b2465e0965b9813c7e_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-18_a8d868015f7e24b2465e0965b9813c7e_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\hasfj.exe"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"2⤵
- Executes dropped EXE
PID:2968
-
Network
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
171 B 171 B 3 3
DNS Request
mytarta.com
DNS Request
mytarta.com
DNS Request
mytarta.com
-
57 B 57 B 1 1
DNS Request
mytarta.com
-
171 B 171 B 3 3
DNS Request
mytarta.com
DNS Request
mytarta.com
DNS Request
mytarta.com
-
171 B 171 B 3 3
DNS Request
mytarta.com
DNS Request
mytarta.com
DNS Request
mytarta.com
-
114 B 114 B 2 2
DNS Request
mytarta.com
DNS Request
mytarta.com
-
171 B 171 B 3 3
DNS Request
mytarta.com
DNS Request
mytarta.com
DNS Request
mytarta.com
-
171 B 171 B 3 3
DNS Request
mytarta.com
DNS Request
mytarta.com
DNS Request
mytarta.com
-
171 B 171 B 3 3
DNS Request
mytarta.com
DNS Request
mytarta.com
DNS Request
mytarta.com
-
171 B 171 B 3 3
DNS Request
mytarta.com
DNS Request
mytarta.com
DNS Request
mytarta.com
-
171 B 171 B 3 3
DNS Request
mytarta.com
DNS Request
mytarta.com
DNS Request
mytarta.com
-
114 B 114 B 2 2
DNS Request
mytarta.com
DNS Request
mytarta.com
-
171 B 171 B 3 3
DNS Request
mytarta.com
DNS Request
mytarta.com
DNS Request
mytarta.com
-
171 B 171 B 3 3
DNS Request
mytarta.com
DNS Request
mytarta.com
DNS Request
mytarta.com
-
114 B 114 B 2 2
DNS Request
mytarta.com
DNS Request
mytarta.com
-
171 B 171 B 3 3
DNS Request
mytarta.com
DNS Request
mytarta.com
DNS Request
mytarta.com
-
171 B 171 B 3 3
DNS Request
mytarta.com
DNS Request
mytarta.com
DNS Request
mytarta.com
-
171 B 171 B 3 3
DNS Request
mytarta.com
DNS Request
mytarta.com
DNS Request
mytarta.com
-
114 B 114 B 2 2
DNS Request
mytarta.com
DNS Request
mytarta.com
-
114 B 114 B 2 2
DNS Request
mytarta.com
DNS Request
mytarta.com
-
171 B 171 B 3 3
DNS Request
mytarta.com
DNS Request
mytarta.com
DNS Request
mytarta.com
-
114 B 114 B 2 2
DNS Request
mytarta.com
DNS Request
mytarta.com
-
171 B 171 B 3 3
DNS Request
mytarta.com
DNS Request
mytarta.com
DNS Request
mytarta.com
-
57 B 57 B 1 1
DNS Request
mytarta.com
-
114 B 114 B 2 2
DNS Request
mytarta.com
DNS Request
mytarta.com
-
57 B 57 B 1 1
DNS Request
mytarta.com
-
171 B 171 B 3 3
DNS Request
mytarta.com
DNS Request
mytarta.com
DNS Request
mytarta.com
-
114 B 114 B 2 2
DNS Request
mytarta.com
DNS Request
mytarta.com
-
171 B 171 B 3 3
DNS Request
mytarta.com
DNS Request
mytarta.com
DNS Request
mytarta.com
-
114 B 114 B 2 2
DNS Request
mytarta.com
DNS Request
mytarta.com
-
114 B 114 B 2 2
DNS Request
mytarta.com
DNS Request
mytarta.com
-
171 B 171 B 3 3
DNS Request
mytarta.com
DNS Request
mytarta.com
DNS Request
mytarta.com
-
114 B 114 B 2 2
DNS Request
mytarta.com
DNS Request
mytarta.com
-
171 B 171 B 3 3
DNS Request
mytarta.com
DNS Request
mytarta.com
DNS Request
mytarta.com
-
171 B 171 B 3 3
DNS Request
mytarta.com
DNS Request
mytarta.com
DNS Request
mytarta.com
-
171 B 171 B 3 3
DNS Request
mytarta.com
DNS Request
mytarta.com
DNS Request
mytarta.com
-
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
389KB
MD5639ffb501498ee7ac56418f4b838a2d7
SHA16f8c395aeccc7ee76e2425324d465c1257ccc168
SHA2567e82e838767913ac49ddaecc5cd8f375bbfd009d6bb5b8769ec95e81c26c74f7
SHA51257c233f955e9a31ddbce3e4843c6f81c0c05435ce9b8694d46840bc1392a439bb968e116035592e751df85a75f451a2580d76615c82043c7b87afe7de67f2d6c