Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24/05/2024, 05:38
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-24_ba554dfc128348d00135679d7056cd8f_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-24_ba554dfc128348d00135679d7056cd8f_cryptolocker.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-05-24_ba554dfc128348d00135679d7056cd8f_cryptolocker.exe
-
Size
42KB
-
MD5
ba554dfc128348d00135679d7056cd8f
-
SHA1
e30b7f70eaa26b689d08d54e179754f83d499797
-
SHA256
11121cdc8039ec1fcc79a1c1323505d1320216f53a4f0a8fa6945e7ce6548f67
-
SHA512
f5112ae8f9625f6a207376118212618fe3b041a1e801df09066d3e4c7b3b60c565ec14ceb37d10b41c4a5a7a0b55d79cc4226639c79886afcfbbc01a91435cb7
-
SSDEEP
768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBaac4HK/wSvuQTCyD/95c:X6QFElP6n+gJQMOtEvwDpjBsYK/fbDF+
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
resource yara_rule behavioral1/files/0x000b000000014fe1-10.dat CryptoLocker_rule2 -
Detection of Cryptolocker Samples 1 IoCs
resource yara_rule behavioral1/files/0x000b000000014fe1-10.dat CryptoLocker_set1 -
Executes dropped EXE 1 IoCs
pid Process 1392 asih.exe -
Loads dropped DLL 1 IoCs
pid Process 2808 2024-05-24_ba554dfc128348d00135679d7056cd8f_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2808 wrote to memory of 1392 2808 2024-05-24_ba554dfc128348d00135679d7056cd8f_cryptolocker.exe 28 PID 2808 wrote to memory of 1392 2808 2024-05-24_ba554dfc128348d00135679d7056cd8f_cryptolocker.exe 28 PID 2808 wrote to memory of 1392 2808 2024-05-24_ba554dfc128348d00135679d7056cd8f_cryptolocker.exe 28 PID 2808 wrote to memory of 1392 2808 2024-05-24_ba554dfc128348d00135679d7056cd8f_cryptolocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_ba554dfc128348d00135679d7056cd8f_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-24_ba554dfc128348d00135679d7056cd8f_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
PID:1392
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD586761b6cb6181bdf0184a89f26f2517b
SHA1818d8749421e4c6165150489ee4c1dc24249010c
SHA25660469fca9a47878ca2f647c265eace7c91220a0dc5b24a8dbe9bff760c43ecf3
SHA512123697f8bc1658ff8fda197536a9b027e8ede718de2ce51c7e35c7d49d48aed5c5a65bd1346b2a54c2041452811be6a017a38f0d73caf180d2c79af63cf6fe59