Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2024, 05:23
Behavioral task
behavioral1
Sample
2024-05-11_08926f99370fbaa312f72b3264600591_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-11_08926f99370fbaa312f72b3264600591_cryptolocker.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-11_08926f99370fbaa312f72b3264600591_cryptolocker.exe
-
Size
56KB
-
MD5
08926f99370fbaa312f72b3264600591
-
SHA1
80613d31506a76a68e008ef77ffeffe83c50c382
-
SHA256
090f2fb3df61f906fc3592eb7b26a01fbbf1ce9d99d84fb7102c3c6d1dc846af
-
SHA512
19b0a804c8a54858431baa8a0dbe5735976d818bff44e164cde2a7b5138169e7913f98e8f2a48235db74814eacf8d77eb5842b9a21c8adb267fe4da07704fafd
-
SSDEEP
768:bP9g/WItCSsAfFaeOcfXVr3BPOz5CFBmNuFgUjlugJp:bP9g/xtCS3Dxx0ep
Malware Config
Signatures
-
Detection of CryptoLocker Variants 2 IoCs
resource yara_rule behavioral2/memory/2300-0-0x0000000000400000-0x000000000040E000-memory.dmp CryptoLocker_rule2 behavioral2/files/0x000800000002348c-13.dat CryptoLocker_rule2 -
UPX dump on OEP (original entry point) 2 IoCs
resource yara_rule behavioral2/memory/2300-0-0x0000000000400000-0x000000000040E000-memory.dmp UPX behavioral2/files/0x000800000002348c-13.dat UPX -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation 2024-05-11_08926f99370fbaa312f72b3264600591_cryptolocker.exe Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation gewos.exe -
Executes dropped EXE 1 IoCs
pid Process 4212 gewos.exe -
resource yara_rule behavioral2/memory/2300-0-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/files/0x000800000002348c-13.dat upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2300 wrote to memory of 4212 2300 2024-05-11_08926f99370fbaa312f72b3264600591_cryptolocker.exe 83 PID 2300 wrote to memory of 4212 2300 2024-05-11_08926f99370fbaa312f72b3264600591_cryptolocker.exe 83 PID 2300 wrote to memory of 4212 2300 2024-05-11_08926f99370fbaa312f72b3264600591_cryptolocker.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-11_08926f99370fbaa312f72b3264600591_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-11_08926f99370fbaa312f72b3264600591_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\gewos.exe"C:\Users\Admin\AppData\Local\Temp\gewos.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
PID:4212
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD550d22f32a22a41c462766b53547bd142
SHA1b76a5829bf8d82a85f9f32042eee6e9002d9dab3
SHA2562625baf6986568eee784203d4e29f407458aca7b062a39db46e39cfb6795529b
SHA512df5f552597cc4297c7c980fc3ab5d3137980f8b8d3ceafe7c99da4cc6527608dd592d1d0d78f6714dc0c34fb8937002745bbc099af2e104440ece46c66989670
-
Filesize
185B
MD534deb086cc238e6cf46761b36e8225cc
SHA12b2414700fc2b9665b686dc849b447f72b6cee6e
SHA25622a66c63dd5b46bbcc7efe9761845119ccf0f5b3d9b2c063361db4e82f58a8ff
SHA512375212fd93aa17b0148391b1274bfcada887e070396b7bcf2267fdf48db365409027c7c5c023f85cc002c1cd24571f690589e9c557b7f3586b13075b4dce4b7a