Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
23/05/2024, 04:23
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-23_222c02d067a4d06f0822d62b65c1c3e4_cryptolocker.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-05-23_222c02d067a4d06f0822d62b65c1c3e4_cryptolocker.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-23_222c02d067a4d06f0822d62b65c1c3e4_cryptolocker.exe
-
Size
48KB
-
MD5
222c02d067a4d06f0822d62b65c1c3e4
-
SHA1
df8a407a74cb78db7cd42a4de61314649399c912
-
SHA256
27a0bf3c76c8328613e85b9a20ba3e6d2cdd98c50963c3d97e8989236ddb4928
-
SHA512
f792af0a30147ccf65d9ea92d585d8a6b0922960db384eedc55ac63e1b68387a77504f380627e77c7e3fec8f8fbd83c8a00c5a027fbc015ce7a7655fce9d103f
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWE6BLbjG9RzhwaRhAj:xj+VGMOtEvwDpjy+TRhE
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
resource yara_rule behavioral1/memory/1848-0-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_rule2 behavioral1/files/0x000b000000014abe-11.dat CryptoLocker_rule2 behavioral1/memory/1848-13-0x0000000002840000-0x0000000002850000-memory.dmp CryptoLocker_rule2 behavioral1/memory/1848-16-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_rule2 behavioral1/memory/2884-26-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_rule2 -
Detection of Cryptolocker Samples 5 IoCs
resource yara_rule behavioral1/memory/1848-0-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_set1 behavioral1/files/0x000b000000014abe-11.dat CryptoLocker_set1 behavioral1/memory/1848-13-0x0000000002840000-0x0000000002850000-memory.dmp CryptoLocker_set1 behavioral1/memory/1848-16-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_set1 behavioral1/memory/2884-26-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_set1 -
Detects executables built or packed with MPress PE compressor 5 IoCs
resource yara_rule behavioral1/memory/1848-0-0x0000000000500000-0x0000000000510000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/files/0x000b000000014abe-11.dat INDICATOR_EXE_Packed_MPress behavioral1/memory/1848-13-0x0000000002840000-0x0000000002850000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/1848-16-0x0000000000500000-0x0000000000510000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/2884-26-0x0000000000500000-0x0000000000510000-memory.dmp INDICATOR_EXE_Packed_MPress -
Executes dropped EXE 1 IoCs
pid Process 2884 misid.exe -
Loads dropped DLL 1 IoCs
pid Process 1848 2024-05-23_222c02d067a4d06f0822d62b65c1c3e4_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1848 wrote to memory of 2884 1848 2024-05-23_222c02d067a4d06f0822d62b65c1c3e4_cryptolocker.exe 28 PID 1848 wrote to memory of 2884 1848 2024-05-23_222c02d067a4d06f0822d62b65c1c3e4_cryptolocker.exe 28 PID 1848 wrote to memory of 2884 1848 2024-05-23_222c02d067a4d06f0822d62b65c1c3e4_cryptolocker.exe 28 PID 1848 wrote to memory of 2884 1848 2024-05-23_222c02d067a4d06f0822d62b65c1c3e4_cryptolocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_222c02d067a4d06f0822d62b65c1c3e4_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_222c02d067a4d06f0822d62b65c1c3e4_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
PID:2884
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD57f9f2dce9e9e4cfdb9dafc5c06df7c90
SHA1603d57c579498c01b4b0bfefe9146b1606432082
SHA2561a74a6e0b9f614dc3cb02971cc036931f8d0c954cd6a1e06c316b9dd8e438a86
SHA5123f7ababe73de015c597a44f7fec6859e4ddeda68993b163816992a580539c0e556bc01a69df2a0b32b9db38e983419636756a66391ab88e7353459ed49d2ab0d