Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
27/04/2024, 05:14
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-27_cedd4166f731ba98f69e48cf14477fa1_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-27_cedd4166f731ba98f69e48cf14477fa1_cryptolocker.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-04-27_cedd4166f731ba98f69e48cf14477fa1_cryptolocker.exe
-
Size
60KB
-
MD5
cedd4166f731ba98f69e48cf14477fa1
-
SHA1
331fd4d37296dd86ce502b4cd50cd04d275b4f7e
-
SHA256
9c0e2f17469c885c99d41ce5cad875133f439e8605b6595fe2a4ed2c4442c98f
-
SHA512
0f3c16b00e12ea9e1f484747d3d635348388ecb8df25e4b77e7c7d21055e7f75d1507aea7e7eacc5c2097425c10ffc2000648e2b0da3d4ff925bc86418c6ed2f
-
SSDEEP
1536:V6QFElP6n+gMQMOtEvwDpjyaLccVCbtCK:V6a+pOtEvwDpjv0
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
resource yara_rule behavioral2/files/0x000c000000023b7c-12.dat CryptoLocker_rule2 -
Detection of Cryptolocker Samples 1 IoCs
resource yara_rule behavioral2/files/0x000c000000023b7c-12.dat CryptoLocker_set1 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation 2024-04-27_cedd4166f731ba98f69e48cf14477fa1_cryptolocker.exe -
Executes dropped EXE 1 IoCs
pid Process 2288 asih.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4548 wrote to memory of 2288 4548 2024-04-27_cedd4166f731ba98f69e48cf14477fa1_cryptolocker.exe 83 PID 4548 wrote to memory of 2288 4548 2024-04-27_cedd4166f731ba98f69e48cf14477fa1_cryptolocker.exe 83 PID 4548 wrote to memory of 2288 4548 2024-04-27_cedd4166f731ba98f69e48cf14477fa1_cryptolocker.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-27_cedd4166f731ba98f69e48cf14477fa1_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-27_cedd4166f731ba98f69e48cf14477fa1_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
PID:2288
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD501be41e9fce7837440cf5432b6a0ccac
SHA176a1ecfe4ad19de527276e1b201443427361ce35
SHA256d0e6bc553e1357b3d94614aa1615ebcdbbd9cf182a0acf45a8ca12a6c6c6a31f
SHA512d6b6a70d7773ce0b764a9f7069e94e8b2a035c8b4ad64b04551ce0c8ccefc802cd6f9d6ee5a690123d4f8f9616d98966bb3aa3d669c980a7e6ab20cf8e9704f2