Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12/09/2024, 02:34
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-12_3c3161ab5e3c0c71051e6180c690ceda_cryptolocker.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-12_3c3161ab5e3c0c71051e6180c690ceda_cryptolocker.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-12_3c3161ab5e3c0c71051e6180c690ceda_cryptolocker.exe
-
Size
48KB
-
MD5
3c3161ab5e3c0c71051e6180c690ceda
-
SHA1
b01290f7cf4965ef74e58c3a82359393d37f7196
-
SHA256
3b3ae41a54d196a887e7baf5e61661b59dd412571ff4ce08da44e880182876be
-
SHA512
2aaa0fcfb86916ed3b7da836fe1e11d3107cc84b162937ce77a36db5ff26e0b900dda8834fca0892e68173e1bccef4bfa709dcc2111411f2b1678d9ea2c9538d
-
SSDEEP
384:e/4wODQkzonAYsju5N/surDQtOOtEvwDpjqIGROqS/WccJVJwi2B5oCCM8CLW2Vt:79inqyNR/QtOOtEvwDpjBKccJVODvy3M
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation 2024-09-12_3c3161ab5e3c0c71051e6180c690ceda_cryptolocker.exe -
Executes dropped EXE 1 IoCs
pid Process 4576 asih.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-09-12_3c3161ab5e3c0c71051e6180c690ceda_cryptolocker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language asih.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4636 wrote to memory of 4576 4636 2024-09-12_3c3161ab5e3c0c71051e6180c690ceda_cryptolocker.exe 84 PID 4636 wrote to memory of 4576 4636 2024-09-12_3c3161ab5e3c0c71051e6180c690ceda_cryptolocker.exe 84 PID 4636 wrote to memory of 4576 4636 2024-09-12_3c3161ab5e3c0c71051e6180c690ceda_cryptolocker.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-12_3c3161ab5e3c0c71051e6180c690ceda_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-12_3c3161ab5e3c0c71051e6180c690ceda_cryptolocker.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4576
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD5deb1466431f90c1ffa5eb1b20d7d5794
SHA1313d30eab391f3b3548b624f4d2ba345f75fb37f
SHA256d5860c773c238adfebb87ce26c0e3bc57e98f7cb7e0fb66a3adea64b4ec2b83d
SHA512327824d91ad943057f7cb9e3314e2a388b63abe30396623800fdb6308d7fcf9991add10d0e0a9c5f131203d9e1935893924b00a3f733efbf5806191738c2ad60