Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02/06/2024, 02:26
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-02_6c546e978cdbb452cc3fe5ce8dc3b33c_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-02_6c546e978cdbb452cc3fe5ce8dc3b33c_cryptolocker.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-02_6c546e978cdbb452cc3fe5ce8dc3b33c_cryptolocker.exe
-
Size
97KB
-
MD5
6c546e978cdbb452cc3fe5ce8dc3b33c
-
SHA1
c081aa8f6503cd93cc0b2ff317d81470d1915ae3
-
SHA256
7a4afaa26fd575504b2f0507c09aa784801647a5127a5c18d6e239128fce3c37
-
SHA512
5a4c1a4e25c781246f0ae9f817779efabaf4a87f16e2f0aa7ed36fcc02d50eddb5464f189a82e04f7c8d8d933876e0fd3cc08cba6b944c25baf50fa40331a355
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZ7uyA36S7MpxRiWNa9mktJYT:xj+VGMOtEvwDpjubwQEIiVmksT
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
resource yara_rule behavioral1/memory/1640-0-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_rule2 behavioral1/memory/1640-14-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_rule2 behavioral1/files/0x000c0000000167ef-11.dat CryptoLocker_rule2 behavioral1/memory/2936-16-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_rule2 behavioral1/memory/2936-26-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_rule2 -
Detection of Cryptolocker Samples 5 IoCs
resource yara_rule behavioral1/memory/1640-0-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_set1 behavioral1/memory/1640-14-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_set1 behavioral1/files/0x000c0000000167ef-11.dat CryptoLocker_set1 behavioral1/memory/2936-16-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_set1 behavioral1/memory/2936-26-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_set1 -
Detects executables built or packed with MPress PE compressor 5 IoCs
resource yara_rule behavioral1/memory/1640-0-0x0000000000500000-0x0000000000510000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/1640-14-0x0000000000500000-0x0000000000510000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/files/0x000c0000000167ef-11.dat INDICATOR_EXE_Packed_MPress behavioral1/memory/2936-16-0x0000000000500000-0x0000000000510000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/2936-26-0x0000000000500000-0x0000000000510000-memory.dmp INDICATOR_EXE_Packed_MPress -
Executes dropped EXE 1 IoCs
pid Process 2936 misid.exe -
Loads dropped DLL 1 IoCs
pid Process 1640 2024-06-02_6c546e978cdbb452cc3fe5ce8dc3b33c_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1640 wrote to memory of 2936 1640 2024-06-02_6c546e978cdbb452cc3fe5ce8dc3b33c_cryptolocker.exe 28 PID 1640 wrote to memory of 2936 1640 2024-06-02_6c546e978cdbb452cc3fe5ce8dc3b33c_cryptolocker.exe 28 PID 1640 wrote to memory of 2936 1640 2024-06-02_6c546e978cdbb452cc3fe5ce8dc3b33c_cryptolocker.exe 28 PID 1640 wrote to memory of 2936 1640 2024-06-02_6c546e978cdbb452cc3fe5ce8dc3b33c_cryptolocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-02_6c546e978cdbb452cc3fe5ce8dc3b33c_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-02_6c546e978cdbb452cc3fe5ce8dc3b33c_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
PID:2936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5615c1a2e4baba6bf80a3a2888b234a91
SHA180258104c9ceec9456e47d78ea4f85ed74f0a695
SHA25625fbd3c0ed438b6417a66f50e1021cd5d9d02f8f0409a2a184b0492cbf8edada
SHA512ded0abc059715b02eaab1f3cc28e9ed5a8da5e4a8adf009cf7a4f94363eca42ced7ae0497632884a09ccc7e13068a4493519b91a24e716f83ef06334d8dfdb6d