Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
26/07/2024, 21:49
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-26_4be4d5754e3b1e98ac0a44380d7fef28_cryptolocker.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2024-07-26_4be4d5754e3b1e98ac0a44380d7fef28_cryptolocker.exe
Resource
win10v2004-20240709-en
General
-
Target
2024-07-26_4be4d5754e3b1e98ac0a44380d7fef28_cryptolocker.exe
-
Size
72KB
-
MD5
4be4d5754e3b1e98ac0a44380d7fef28
-
SHA1
05a302fd4cabcb35823b99f9442bbf3ca5ce6c79
-
SHA256
649053328aee94049d367e57f49ed06df515d0cf97c1b5194745919894146130
-
SHA512
1c623d75e01d0d52ebc33ea521addfd2d5ec35f52a38f2528e832c607bbf1359cdf5c130d469107919b45bc64c28e34575a96c04b51d6b36cc40312a177670c3
-
SSDEEP
768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4ZPsED3VK2+ZtyOjgO4r9vFAg2rq2g1B/Rp:vj+jsMQMOtEvwDpj5HZYTjipvF24x
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1708 misid.exe -
Loads dropped DLL 1 IoCs
pid Process 1020 2024-07-26_4be4d5754e3b1e98ac0a44380d7fef28_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-07-26_4be4d5754e3b1e98ac0a44380d7fef28_cryptolocker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language misid.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1020 wrote to memory of 1708 1020 2024-07-26_4be4d5754e3b1e98ac0a44380d7fef28_cryptolocker.exe 29 PID 1020 wrote to memory of 1708 1020 2024-07-26_4be4d5754e3b1e98ac0a44380d7fef28_cryptolocker.exe 29 PID 1020 wrote to memory of 1708 1020 2024-07-26_4be4d5754e3b1e98ac0a44380d7fef28_cryptolocker.exe 29 PID 1020 wrote to memory of 1708 1020 2024-07-26_4be4d5754e3b1e98ac0a44380d7fef28_cryptolocker.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-26_4be4d5754e3b1e98ac0a44380d7fef28_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-26_4be4d5754e3b1e98ac0a44380d7fef28_cryptolocker.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1708
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD5054dd9d093c29e51228f827cdaaf9c91
SHA1bb17ea755839c25afcf31999c2fb36ec9d87c7cd
SHA256e8ada49e5c49f1b9969aa0fe018dc3c91fb0c9988b93f44735bfceae99237eff
SHA512211995520d5e4a1b3b0afd557c1b8f7ce5923bd4b4102e3265d1f2ed309b98d6be3f713eab044d7d1396b2d3dd92795f0974834af322d8615c4c0d40ab33db01