Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
21/04/2024, 04:38
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-21_e5a1280f649da9528aa31809e491c347_cryptolocker.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-04-21_e5a1280f649da9528aa31809e491c347_cryptolocker.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-21_e5a1280f649da9528aa31809e491c347_cryptolocker.exe
-
Size
46KB
-
MD5
e5a1280f649da9528aa31809e491c347
-
SHA1
9a7cc7c834a0413d5c7cc78eb9ffb2528fdd5ad7
-
SHA256
d62c6030cccf470d6dc03f969aaf8eaf82c6c3680bcc69142141ccc23128fd73
-
SHA512
e99a8316cf56e2b224c1ccbefff1c666662ec471667f0e5e3f926edcc50dc306a80b715bfd6ea13d1ff9bb2d28c5a6a6ea84dc0eedbff1d7a1d174fec9b38359
-
SSDEEP
768:79inqyNR/QtOOtEvwDpjBKccJVODvccwDFUu:79mqyNhQMOtEvwDpjBzck1Wx
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
resource yara_rule behavioral1/memory/2064-0-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_rule2 behavioral1/files/0x000a00000001220d-11.dat CryptoLocker_rule2 behavioral1/memory/2064-15-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_rule2 behavioral1/memory/2680-17-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_rule2 behavioral1/memory/2064-13-0x0000000000690000-0x000000000069F000-memory.dmp CryptoLocker_rule2 -
Detection of Cryptolocker Samples 5 IoCs
resource yara_rule behavioral1/memory/2064-0-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_set1 behavioral1/files/0x000a00000001220d-11.dat CryptoLocker_set1 behavioral1/memory/2064-15-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_set1 behavioral1/memory/2680-17-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_set1 behavioral1/memory/2064-13-0x0000000000690000-0x000000000069F000-memory.dmp CryptoLocker_set1 -
Executes dropped EXE 1 IoCs
pid Process 2680 asih.exe -
Loads dropped DLL 1 IoCs
pid Process 2064 2024-04-21_e5a1280f649da9528aa31809e491c347_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2064 wrote to memory of 2680 2064 2024-04-21_e5a1280f649da9528aa31809e491c347_cryptolocker.exe 28 PID 2064 wrote to memory of 2680 2064 2024-04-21_e5a1280f649da9528aa31809e491c347_cryptolocker.exe 28 PID 2064 wrote to memory of 2680 2064 2024-04-21_e5a1280f649da9528aa31809e491c347_cryptolocker.exe 28 PID 2064 wrote to memory of 2680 2064 2024-04-21_e5a1280f649da9528aa31809e491c347_cryptolocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-21_e5a1280f649da9528aa31809e491c347_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-21_e5a1280f649da9528aa31809e491c347_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
PID:2680
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD5aab04f0c11a5601589d9c596c0fd92eb
SHA161de610398045ca17a2337333d54e4604e557748
SHA2562857939435516db4cee7a399ad86b646484c51cf4c3d37fa915b53c72486b4d7
SHA51298809e58078369735baf8fd815e63a84a59bc762014c11dccfb4e2c404dba2bd90790eebeee02537ee5291102dc5aba9a634331de4eff572af8e3ebaf9e125fd