Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01/06/2024, 08:25
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-01_5d5008fe06603752e27c93cf7860d982_cryptolocker.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-01_5d5008fe06603752e27c93cf7860d982_cryptolocker.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-01_5d5008fe06603752e27c93cf7860d982_cryptolocker.exe
-
Size
46KB
-
MD5
5d5008fe06603752e27c93cf7860d982
-
SHA1
34884431a600f265806ef8b23b7929f4227ebf9f
-
SHA256
f0fd4957cd45f766244bac22e0571c4cc155360ee2a476657c1bcb811df50043
-
SHA512
b3b344d42a9bcd1bead4e80093aee84ac11b3b16fa388c00c4aea203e4e93dce34d2c3a61d259eb345f8e33428c70ca80b919958f10b6e3e95fdce36072ded00
-
SSDEEP
768:b7o/2n1TCraU6GD1a4X0WcO+wMVm+slAMphqc:bc/y2lkF0+Beqc
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
resource yara_rule behavioral2/files/0x0008000000022f51-12.dat CryptoLocker_rule2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 2024-06-01_5d5008fe06603752e27c93cf7860d982_cryptolocker.exe -
Executes dropped EXE 1 IoCs
pid Process 3016 rewok.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5040 wrote to memory of 3016 5040 2024-06-01_5d5008fe06603752e27c93cf7860d982_cryptolocker.exe 83 PID 5040 wrote to memory of 3016 5040 2024-06-01_5d5008fe06603752e27c93cf7860d982_cryptolocker.exe 83 PID 5040 wrote to memory of 3016 5040 2024-06-01_5d5008fe06603752e27c93cf7860d982_cryptolocker.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-01_5d5008fe06603752e27c93cf7860d982_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-01_5d5008fe06603752e27c93cf7860d982_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\rewok.exe"C:\Users\Admin\AppData\Local\Temp\rewok.exe"2⤵
- Executes dropped EXE
PID:3016
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD5dd9c1eeb1f7372723c756eb26493d22a
SHA1e6081ccd907579531fa59023071e37ce3a128a9a
SHA2562abbe100b3c0068eb3ca3ceba3319d9a1197d41652279ff291f0a8022166c0f4
SHA51214874d328289383860016643ab6e690dfb7d9ed9fe6f835b65fb438f4dba6121ff4506a173b215e7d4be495c568c34e8e35a1e360a2cf1e18addcdd410886d25