Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24/05/2024, 04:25
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-24_3370a742834a6e4873a186a27f31c61e_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-24_3370a742834a6e4873a186a27f31c61e_cryptolocker.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-24_3370a742834a6e4873a186a27f31c61e_cryptolocker.exe
-
Size
41KB
-
MD5
3370a742834a6e4873a186a27f31c61e
-
SHA1
b77c4b0c0597a13e6cedf52608e9e1eb1f5c058b
-
SHA256
8c6dd549b6fb32f8815d415c6b7ffe0e71114cd3af1c96b17dcf22e4e79e0eec
-
SHA512
0862bfd2567809d5cda570a482b9318840f3917c9de2852201ce8c28f18b9917537232235f4fff730967faff30baa018f938d2d248456f02b5ff021ff459a53b
-
SSDEEP
384:btBYQg/WIEhUCSNyepEjYnDOAlzVol6U/zzo+tkq4XDIwNiJXxXunKzH15U/Ey/A:btB9g/WItCSsAGjX7e9N0hunKLYNOZN
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
resource yara_rule behavioral2/files/0x000800000002343b-12.dat CryptoLocker_rule2 -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation 2024-05-24_3370a742834a6e4873a186a27f31c61e_cryptolocker.exe Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation gewos.exe -
Executes dropped EXE 1 IoCs
pid Process 5060 gewos.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2808 wrote to memory of 5060 2808 2024-05-24_3370a742834a6e4873a186a27f31c61e_cryptolocker.exe 85 PID 2808 wrote to memory of 5060 2808 2024-05-24_3370a742834a6e4873a186a27f31c61e_cryptolocker.exe 85 PID 2808 wrote to memory of 5060 2808 2024-05-24_3370a742834a6e4873a186a27f31c61e_cryptolocker.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_3370a742834a6e4873a186a27f31c61e_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-24_3370a742834a6e4873a186a27f31c61e_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\gewos.exe"C:\Users\Admin\AppData\Local\Temp\gewos.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
PID:5060
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD533a8b824ede98f3b8286fd0cc6032100
SHA1a22f41cdec623e1a03e1bc04d58a7cbfd0c0ca69
SHA256408d7f2c744b13317baff85aa793e7530f2f07d4f4f3c90fc539f26fbcb6d637
SHA51238c63229f14b062bbd79c44faf7f870763190647c9f75fe2c47f204a5d93fdc09bb363c321800860d1adcc5582a2bfa8f9e4f784f9fd64fcc134c6358a1bf451
-
Filesize
185B
MD53842c96c28eaec4440ac965398c10565
SHA12606117076a25bba51b3048ec651df98b79bd577
SHA256cc6db1a8a225e20b4a83597d8bca7a23efacafea61859fa1d86ffdbbf9f6a576
SHA5125f04dc089b4030f47ce9a784a2084d9c38cb9d74935fc90d1a6e26df4c277368c93643523942897f13a4dcda13567f9e544d9ac6c3460d8034d5c9bda68baab3