Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
24/05/2024, 13:30
Behavioral task
behavioral1
Sample
2024-05-24_fa64b2944373f55f8816c6ef3d226853_cryptolocker.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2024-05-24_fa64b2944373f55f8816c6ef3d226853_cryptolocker.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-24_fa64b2944373f55f8816c6ef3d226853_cryptolocker.exe
-
Size
73KB
-
MD5
fa64b2944373f55f8816c6ef3d226853
-
SHA1
bc0a066ac49eb562651103201d42b5880a15d2e6
-
SHA256
e95cc2307444ecd53c50abf7cdcbb25ea1bce6850ac3ed5cd988c923f3cf0939
-
SHA512
c585fe991e74479b6cc63722ea87e3b91d0c5364b2f0e541673c1bb1a8ad27115558dfbffb0af11cb67f0f8ef9cc4de02760329b5fe3b3ba92bfc93a27cfbe6d
-
SSDEEP
1536:nj+4zs2cPVhlMOtEvwDpj4H8u8rZVTs975:C4Q2c94OtEvwDpj4H8zs
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
resource yara_rule behavioral1/memory/2176-0-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_rule2 behavioral1/files/0x000b000000012279-11.dat CryptoLocker_rule2 behavioral1/memory/2176-15-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_rule2 behavioral1/memory/1648-25-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_rule2 -
Detection of Cryptolocker Samples 2 IoCs
resource yara_rule behavioral1/memory/2176-15-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_set1 behavioral1/memory/1648-25-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_set1 -
UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral1/memory/2176-0-0x0000000000500000-0x0000000000510000-memory.dmp UPX behavioral1/files/0x000b000000012279-11.dat UPX behavioral1/memory/2176-15-0x0000000000500000-0x0000000000510000-memory.dmp UPX behavioral1/memory/1648-25-0x0000000000500000-0x0000000000510000-memory.dmp UPX -
Executes dropped EXE 1 IoCs
pid Process 1648 misid.exe -
Loads dropped DLL 1 IoCs
pid Process 2176 2024-05-24_fa64b2944373f55f8816c6ef3d226853_cryptolocker.exe -
resource yara_rule behavioral1/memory/2176-0-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/files/0x000b000000012279-11.dat upx behavioral1/memory/2176-15-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/memory/1648-25-0x0000000000500000-0x0000000000510000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2176 wrote to memory of 1648 2176 2024-05-24_fa64b2944373f55f8816c6ef3d226853_cryptolocker.exe 28 PID 2176 wrote to memory of 1648 2176 2024-05-24_fa64b2944373f55f8816c6ef3d226853_cryptolocker.exe 28 PID 2176 wrote to memory of 1648 2176 2024-05-24_fa64b2944373f55f8816c6ef3d226853_cryptolocker.exe 28 PID 2176 wrote to memory of 1648 2176 2024-05-24_fa64b2944373f55f8816c6ef3d226853_cryptolocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_fa64b2944373f55f8816c6ef3d226853_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-24_fa64b2944373f55f8816c6ef3d226853_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
PID:1648
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD5835fcb943bda7daadd1efaa71c586779
SHA14e7d7b505dc70787f7daadc2f97c13ce61b4bf63
SHA256940c04d6e027d1374d5664f93a9feada9c8b74f64ad20946e8b0106818fe2ad3
SHA512a1ad19dc7ae19635d239aa4e2a79feee722ac39fa188b4f4c2b4d7a5d3574337497f8ec39ba05b2cad127f2215560b9cdb89ce48efad5abe6c4bee4756f514c9