Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
27/06/2024, 21:32
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-27_dda2c6c0d4039d332ef28d229f43aa9f_cryptolocker.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-06-27_dda2c6c0d4039d332ef28d229f43aa9f_cryptolocker.exe
Resource
win10v2004-20240611-en
General
-
Target
2024-06-27_dda2c6c0d4039d332ef28d229f43aa9f_cryptolocker.exe
-
Size
46KB
-
MD5
dda2c6c0d4039d332ef28d229f43aa9f
-
SHA1
c219bd7eee294ae4df72047ea3422294e0f204b5
-
SHA256
2ebc16621d60e82d99f4647c14a63da2a1d3423d11c807a01de15f8f309edfab
-
SHA512
824bef276bb360f28200506367baf8f9c2224cb566f66b0b67f6e25771294adec493c8eac06fcf07441be3afb6896fc23302cd575b912de004336e71c5f13ff9
-
SSDEEP
768:bao/2n1TCraU6GD1a4X1XOQ69zbjlAAX5e9z1:bF/y2lFizbR9Xwz1
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation 2024-06-27_dda2c6c0d4039d332ef28d229f43aa9f_cryptolocker.exe -
Executes dropped EXE 1 IoCs
pid Process 528 rewok.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2456 wrote to memory of 528 2456 2024-06-27_dda2c6c0d4039d332ef28d229f43aa9f_cryptolocker.exe 82 PID 2456 wrote to memory of 528 2456 2024-06-27_dda2c6c0d4039d332ef28d229f43aa9f_cryptolocker.exe 82 PID 2456 wrote to memory of 528 2456 2024-06-27_dda2c6c0d4039d332ef28d229f43aa9f_cryptolocker.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-27_dda2c6c0d4039d332ef28d229f43aa9f_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-27_dda2c6c0d4039d332ef28d229f43aa9f_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\rewok.exe"C:\Users\Admin\AppData\Local\Temp\rewok.exe"2⤵
- Executes dropped EXE
PID:528
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD5c47c7c9ff037b3c2164a8c5821086cba
SHA194c69a4802980f64d6658d0cde9a5d756873052f
SHA256cb7c2f1c9905dba2f21ec133aa8b404aa40c985616627bc72939f76330361d36
SHA51272caa54a2357f06cae611c893379f7a2d3f6bce1302990f69db08d7690f371e26ebd23df4c292dede3cfc26751452f3764819f909842e0c01b4091386391d6e8