Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30/05/2024, 21:00
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-30_2cc6c50ba36baae88880bb02a7feeb7d_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-30_2cc6c50ba36baae88880bb02a7feeb7d_cryptolocker.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-30_2cc6c50ba36baae88880bb02a7feeb7d_cryptolocker.exe
-
Size
38KB
-
MD5
2cc6c50ba36baae88880bb02a7feeb7d
-
SHA1
5ce1935e8e02a6f7e99f8d110a68ccdd38283780
-
SHA256
424fe64ca63768ffce1e62c7236724ba8c205d7090a5f28d1ecbfd9fd02558fc
-
SHA512
b747afe38bb7e1596f075bc617d9655a3ccb8605bdba7bd9c71d5480422835b0e52651efe2128e26a7261c225fb01f1b5e7b020f1310437c5e40611b23e7c60a
-
SSDEEP
768:fTz7y3lhsT+hs1SQtOOtEvwDpjfAu9+4S:fT+hsMQMOtEvwDpjoIHS
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
resource yara_rule behavioral1/files/0x000d000000014909-10.dat CryptoLocker_rule2 -
Detection of Cryptolocker Samples 1 IoCs
resource yara_rule behavioral1/files/0x000d000000014909-10.dat CryptoLocker_set1 -
Executes dropped EXE 1 IoCs
pid Process 2440 misid.exe -
Loads dropped DLL 1 IoCs
pid Process 1664 2024-05-30_2cc6c50ba36baae88880bb02a7feeb7d_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1664 wrote to memory of 2440 1664 2024-05-30_2cc6c50ba36baae88880bb02a7feeb7d_cryptolocker.exe 28 PID 1664 wrote to memory of 2440 1664 2024-05-30_2cc6c50ba36baae88880bb02a7feeb7d_cryptolocker.exe 28 PID 1664 wrote to memory of 2440 1664 2024-05-30_2cc6c50ba36baae88880bb02a7feeb7d_cryptolocker.exe 28 PID 1664 wrote to memory of 2440 1664 2024-05-30_2cc6c50ba36baae88880bb02a7feeb7d_cryptolocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-30_2cc6c50ba36baae88880bb02a7feeb7d_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-30_2cc6c50ba36baae88880bb02a7feeb7d_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
PID:2440
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD5a7b158735cedc6faa8c86ab7ad928eef
SHA1ad6301f841f2cea33d60f079a4f8fd66eb28a567
SHA256e779ff12028bfdee14a3957cc0bab19538a5eb415a8ac396d5444472e685fcff
SHA5122beb092c5008cacb832e5cbfe9920b8bbc4916f57384fa8bebf8af0236da08231039d7a9b0f1c4383eae5364b9d1fe504701e5b6767ef48608151f89c49b5cf0