Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/05/2024, 05:23
Behavioral task
behavioral1
Sample
2024-05-11_08926f99370fbaa312f72b3264600591_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-11_08926f99370fbaa312f72b3264600591_cryptolocker.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-11_08926f99370fbaa312f72b3264600591_cryptolocker.exe
-
Size
56KB
-
MD5
08926f99370fbaa312f72b3264600591
-
SHA1
80613d31506a76a68e008ef77ffeffe83c50c382
-
SHA256
090f2fb3df61f906fc3592eb7b26a01fbbf1ce9d99d84fb7102c3c6d1dc846af
-
SHA512
19b0a804c8a54858431baa8a0dbe5735976d818bff44e164cde2a7b5138169e7913f98e8f2a48235db74814eacf8d77eb5842b9a21c8adb267fe4da07704fafd
-
SSDEEP
768:bP9g/WItCSsAfFaeOcfXVr3BPOz5CFBmNuFgUjlugJp:bP9g/xtCS3Dxx0ep
Malware Config
Signatures
-
Detection of CryptoLocker Variants 2 IoCs
resource yara_rule behavioral1/memory/1712-0-0x0000000000400000-0x000000000040E000-memory.dmp CryptoLocker_rule2 behavioral1/files/0x000b0000000143e5-14.dat CryptoLocker_rule2 -
UPX dump on OEP (original entry point) 2 IoCs
resource yara_rule behavioral1/memory/1712-0-0x0000000000400000-0x000000000040E000-memory.dmp UPX behavioral1/files/0x000b0000000143e5-14.dat UPX -
Executes dropped EXE 1 IoCs
pid Process 2976 gewos.exe -
Loads dropped DLL 1 IoCs
pid Process 1712 2024-05-11_08926f99370fbaa312f72b3264600591_cryptolocker.exe -
resource yara_rule behavioral1/memory/1712-0-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/files/0x000b0000000143e5-14.dat upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1712 2024-05-11_08926f99370fbaa312f72b3264600591_cryptolocker.exe 2976 gewos.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1712 wrote to memory of 2976 1712 2024-05-11_08926f99370fbaa312f72b3264600591_cryptolocker.exe 28 PID 1712 wrote to memory of 2976 1712 2024-05-11_08926f99370fbaa312f72b3264600591_cryptolocker.exe 28 PID 1712 wrote to memory of 2976 1712 2024-05-11_08926f99370fbaa312f72b3264600591_cryptolocker.exe 28 PID 1712 wrote to memory of 2976 1712 2024-05-11_08926f99370fbaa312f72b3264600591_cryptolocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-11_08926f99370fbaa312f72b3264600591_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-11_08926f99370fbaa312f72b3264600591_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\gewos.exe"C:\Users\Admin\AppData\Local\Temp\gewos.exe"2⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2976
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD550d22f32a22a41c462766b53547bd142
SHA1b76a5829bf8d82a85f9f32042eee6e9002d9dab3
SHA2562625baf6986568eee784203d4e29f407458aca7b062a39db46e39cfb6795529b
SHA512df5f552597cc4297c7c980fc3ab5d3137980f8b8d3ceafe7c99da4cc6527608dd592d1d0d78f6714dc0c34fb8937002745bbc099af2e104440ece46c66989670