Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09/06/2024, 07:27
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-09_627e1fbec0f24b814f63eee5ee1f71ad_cryptolocker.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-06-09_627e1fbec0f24b814f63eee5ee1f71ad_cryptolocker.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-06-09_627e1fbec0f24b814f63eee5ee1f71ad_cryptolocker.exe
-
Size
49KB
-
MD5
627e1fbec0f24b814f63eee5ee1f71ad
-
SHA1
fb112f3589417d4c2d8932f37ff933dbe91c047c
-
SHA256
667c2e5182c05bfe7e8173b88c696003b89b808a3469f2c5b89ce6e02bd52461
-
SHA512
01d6eb2220469b070ecb9a0a85f69c38af254d6aac7c5ff85e23766e2a5c526873ae19493ed575fe0f82908abb8f3ccc98e1369c432bf1973ec00309e22b1ddb
-
SSDEEP
768:P6LsoVEeegiZPvEhHSP+gp/QtOOtEvwDpjBBMLZdzuqpXsiE8Wq/DpkcAYZG:P6Q0ElP6G+gJQMOtEvwDpjB8WMlf/ZG
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
resource yara_rule behavioral2/memory/5056-0-0x0000000000500000-0x000000000050B000-memory.dmp CryptoLocker_rule2 behavioral2/files/0x000800000002327d-13.dat CryptoLocker_rule2 behavioral2/memory/5056-18-0x0000000000500000-0x000000000050B000-memory.dmp CryptoLocker_rule2 behavioral2/memory/1312-16-0x0000000000500000-0x000000000050B000-memory.dmp CryptoLocker_rule2 behavioral2/memory/1312-27-0x0000000000500000-0x000000000050B000-memory.dmp CryptoLocker_rule2 -
Detection of Cryptolocker Samples 5 IoCs
resource yara_rule behavioral2/memory/5056-0-0x0000000000500000-0x000000000050B000-memory.dmp CryptoLocker_set1 behavioral2/files/0x000800000002327d-13.dat CryptoLocker_set1 behavioral2/memory/5056-18-0x0000000000500000-0x000000000050B000-memory.dmp CryptoLocker_set1 behavioral2/memory/1312-16-0x0000000000500000-0x000000000050B000-memory.dmp CryptoLocker_set1 behavioral2/memory/1312-27-0x0000000000500000-0x000000000050B000-memory.dmp CryptoLocker_set1 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation 2024-06-09_627e1fbec0f24b814f63eee5ee1f71ad_cryptolocker.exe -
Executes dropped EXE 1 IoCs
pid Process 1312 asih.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5056 wrote to memory of 1312 5056 2024-06-09_627e1fbec0f24b814f63eee5ee1f71ad_cryptolocker.exe 83 PID 5056 wrote to memory of 1312 5056 2024-06-09_627e1fbec0f24b814f63eee5ee1f71ad_cryptolocker.exe 83 PID 5056 wrote to memory of 1312 5056 2024-06-09_627e1fbec0f24b814f63eee5ee1f71ad_cryptolocker.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-09_627e1fbec0f24b814f63eee5ee1f71ad_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-09_627e1fbec0f24b814f63eee5ee1f71ad_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
PID:1312
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49KB
MD59c3df63ca77468416988ce33cd2c0959
SHA18d923267c08a9d3d25da1ce9757ef6072fe02fd6
SHA256fd208dc01735b01dfed61710a767c3b77d92717a1cf68f24a9c2f7e5c158bc6c
SHA5123f256402f12f3e8d0fbd5802595508fa62ef6b9cce7d3cecfe2673b5e9763dc8c7bfa2a7f92141ae08e70f4ea0a87425b2169a30a1348535ced3904afa026dd7