Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/09/2024, 13:22
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-04_1fce33c15d15e7acafccfc088ca39e0c_cryptolocker.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-04_1fce33c15d15e7acafccfc088ca39e0c_cryptolocker.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-04_1fce33c15d15e7acafccfc088ca39e0c_cryptolocker.exe
-
Size
46KB
-
MD5
1fce33c15d15e7acafccfc088ca39e0c
-
SHA1
e554ac7cb9eaedbada727bc99d2214e192f9e93a
-
SHA256
396968fa258395e674092ecaa41b1fd0e3358e3acb26c35fa4525d7cb6d46096
-
SHA512
01d6b0a8693b13af1b43511fe7e53725d9f26a1c8a1524457f18fdd3153c6c269c45d9080c24a2f3cb631677ee9ee51107c70b34180e256c05c362c0fbf398c8
-
SSDEEP
768:bao/2n1TCraU6GD1a4X1XOQ69zbjlAAX5e9zu:bF/y2lFizbR9Xwzu
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1716 rewok.exe -
Loads dropped DLL 1 IoCs
pid Process 3020 2024-09-04_1fce33c15d15e7acafccfc088ca39e0c_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-09-04_1fce33c15d15e7acafccfc088ca39e0c_cryptolocker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rewok.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 3020 2024-09-04_1fce33c15d15e7acafccfc088ca39e0c_cryptolocker.exe 1716 rewok.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3020 wrote to memory of 1716 3020 2024-09-04_1fce33c15d15e7acafccfc088ca39e0c_cryptolocker.exe 30 PID 3020 wrote to memory of 1716 3020 2024-09-04_1fce33c15d15e7acafccfc088ca39e0c_cryptolocker.exe 30 PID 3020 wrote to memory of 1716 3020 2024-09-04_1fce33c15d15e7acafccfc088ca39e0c_cryptolocker.exe 30 PID 3020 wrote to memory of 1716 3020 2024-09-04_1fce33c15d15e7acafccfc088ca39e0c_cryptolocker.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-04_1fce33c15d15e7acafccfc088ca39e0c_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-04_1fce33c15d15e7acafccfc088ca39e0c_cryptolocker.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\rewok.exe"C:\Users\Admin\AppData\Local\Temp\rewok.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
PID:1716
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD512a471506879ccc5d3925737b90af548
SHA1c666704be9f4562b3f8e8179bc32ed3b2662d404
SHA2563b986aa2a63bd8fda89f851916b49eded6f848c68f6aea9891b6b8039c9e4494
SHA512596e8725db5fc414183cf3cfd6dc727e5950c4db4c2459f7c9590bea99f0fe36a970eec4b67495edbd593cd27b41303a644cb62d29a380d867fc1f71ce900179