Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/06/2024, 06:15
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-10_cb66f2aaf85b434bd6af3269533cb1f5_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-10_cb66f2aaf85b434bd6af3269533cb1f5_cryptolocker.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-10_cb66f2aaf85b434bd6af3269533cb1f5_cryptolocker.exe
-
Size
63KB
-
MD5
cb66f2aaf85b434bd6af3269533cb1f5
-
SHA1
314fc276a76a34e62b53a26b8d0ed03c9820bd33
-
SHA256
60a1ddf20dba95b94f053511d5f63b4d3ddb30c60f17296059bd5bbf0c99837e
-
SHA512
66c0ac7e552f0ef4d673d6bcacd6ed2e365ce05f3b9c05d625006bfba9417be0a662d9f46bb81b9949472f38366f5b805bee1162752a9e3edf10d3249369ac0b
-
SSDEEP
1536:btB9g/xtCSKfxLIc//Xr+/AO/kIZ3ft2nVuTKB6nggOlHdUHZnx8:btng54SMLr+/AO/kIhfoKMHda2
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
resource yara_rule behavioral2/files/0x00090000000233ea-12.dat CryptoLocker_rule2 -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 2024-06-10_cb66f2aaf85b434bd6af3269533cb1f5_cryptolocker.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation gewos.exe -
Executes dropped EXE 1 IoCs
pid Process 1804 gewos.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3904 wrote to memory of 1804 3904 2024-06-10_cb66f2aaf85b434bd6af3269533cb1f5_cryptolocker.exe 82 PID 3904 wrote to memory of 1804 3904 2024-06-10_cb66f2aaf85b434bd6af3269533cb1f5_cryptolocker.exe 82 PID 3904 wrote to memory of 1804 3904 2024-06-10_cb66f2aaf85b434bd6af3269533cb1f5_cryptolocker.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-10_cb66f2aaf85b434bd6af3269533cb1f5_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-10_cb66f2aaf85b434bd6af3269533cb1f5_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\gewos.exe"C:\Users\Admin\AppData\Local\Temp\gewos.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
PID:1804
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
63KB
MD5b0b052ca31aaf82ad07052ddcacee9b0
SHA17b39d08b13c39ff3bf0da7871ffd758898fc2bb7
SHA256ffaf2646ba6fab93fd2395fa495312875fbc178f46d2a793c143a801a6afc2b3
SHA512e8ba1eed4394866feb457b88ef0213fe9d54977923223f7ffb1d466b99245e0ac17dd538ba798be9490c3e775bdfb0307b82b370b5118ea53faa9d3c32401dca
-
Filesize
185B
MD54f1929f5a0d95ae73abb62736e03d7df
SHA15bd26f8551495ef697681dcebb49f57b1a47a7f1
SHA256ee18da8a45a3de4faac69a0bde3c738e15ad2ad986e84491ac00a6b9f825181f
SHA512369e2d80981344ed7b06573c42e985d2c107a1c344e29ba4c4c7c48a14d382d2662b7c5a729c2ad98ef314fe1ceb45b28fcf450f854d952620480bc89b18acde