Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1049s -
max time network
959s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12/05/2024, 21:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CryptoLocker (2013).exe
Resource
win10v2004-20240508-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
CryptoLocker (2013).exe
-
Size
827KB
-
MD5
7f9c454a2e016e533e181d53eba113bc
-
SHA1
694dc7713537a7237030f7623881423fcb8d8c5c
-
SHA256
c7dc529d8aae76b4e797e4e9e3ea7cd69669e6c3bb3f94d80f1974d1b9f69378
-
SHA512
6869cf5a7c3526acf402b1ef09a9477dedf6cf534ff728e0823b9413ba41e888bd5b61cc20421d4a799df493126598a4a906ac2ab46147d9e4bcfa5d3600a110
-
SSDEEP
12288:06NINoPgXqvRyq5E3R18y0kQzX3EL1TdB0JUsoSfsJuRqQy5d5t:06iWP9JAR18ycD3ErB2rs8MQy5
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4428 4264 WerFault.exe 89 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4728 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4728 taskmgr.exe Token: SeSystemProfilePrivilege 4728 taskmgr.exe Token: SeCreateGlobalPrivilege 4728 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe 4728 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\CryptoLocker (2013).exe"C:\Users\Admin\AppData\Local\Temp\CryptoLocker (2013).exe"1⤵PID:4264
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 4082⤵
- Program crash
PID:4428
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4264 -ip 42641⤵PID:4448
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4076,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:81⤵PID:4380
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4728
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4188,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:81⤵PID:3632