Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
23/04/2024, 23:31
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-23_b18986a808394c15e18f60e7da792512_cryptolocker.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-04-23_b18986a808394c15e18f60e7da792512_cryptolocker.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-23_b18986a808394c15e18f60e7da792512_cryptolocker.exe
-
Size
73KB
-
MD5
b18986a808394c15e18f60e7da792512
-
SHA1
cd84d2a1974f188fdca29085aa06f3e71523ec6f
-
SHA256
c1612cf2f706062a25dda9d6fdff2ad2980514e5ca8a539b99ee6d5af170ff14
-
SHA512
d2cc17b3ffb1d14cb21d33466aa5208cf6d364b197040d42e108ce472298b7ae776aa85335d8d8011651fe4624d163c550b0118a48357907316c16942ce4eab0
-
SSDEEP
1536:X6QFElP6n+gJQMOtEvwDpjBZYTjipvF2bx1svrt:X6a+SOtEvwDpjBZYvQd28x
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
resource yara_rule behavioral1/files/0x000c000000012326-10.dat CryptoLocker_rule2 -
Detection of Cryptolocker Samples 1 IoCs
resource yara_rule behavioral1/files/0x000c000000012326-10.dat CryptoLocker_set1 -
Executes dropped EXE 1 IoCs
pid Process 2712 asih.exe -
Loads dropped DLL 1 IoCs
pid Process 1956 2024-04-23_b18986a808394c15e18f60e7da792512_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1956 wrote to memory of 2712 1956 2024-04-23_b18986a808394c15e18f60e7da792512_cryptolocker.exe 28 PID 1956 wrote to memory of 2712 1956 2024-04-23_b18986a808394c15e18f60e7da792512_cryptolocker.exe 28 PID 1956 wrote to memory of 2712 1956 2024-04-23_b18986a808394c15e18f60e7da792512_cryptolocker.exe 28 PID 1956 wrote to memory of 2712 1956 2024-04-23_b18986a808394c15e18f60e7da792512_cryptolocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-23_b18986a808394c15e18f60e7da792512_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-23_b18986a808394c15e18f60e7da792512_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
PID:2712
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD5aa4e8b67c89f88dd646b8befaa0d52fa
SHA1c5c0f3eabc37dab3eb78006355bcb82bc39e233a
SHA2560ae624386f9a6d087c0e39a8dbbb8fa11ddfa5a04953c1fe3e4eae35639d8706
SHA5123f91ee73ef30fcf7b38e93a4739fc4da51bf9ede53e1d14ef9bcecd73aeaee860ca62abffc0c0f227a6437bb19d2029b707de82df56e7842d50409df99b0fb06