Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12/09/2024, 02:41
Behavioral task
behavioral1
Sample
2024-09-12_69362027900682e65ee6ce494906fed7_cryptolocker.exe
Resource
win7-20240903-en
General
-
Target
2024-09-12_69362027900682e65ee6ce494906fed7_cryptolocker.exe
-
Size
35KB
-
MD5
69362027900682e65ee6ce494906fed7
-
SHA1
1c3e04b154e3b84e49a2e44231f972d261e4a248
-
SHA256
ecedb2c9e0ce159ad13ff258d6c4f0739288af124b368ac76523e206c7ce339b
-
SHA512
2ca6ea2fbc944ec8f3de3a8033b95064f4d1fe2d9e85460d60eaf432d889939d7e1c2515bc8f2e56ef921df479612e922cf2ba103c37d27183fba2dcc64fe656
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITV:qDdFJy3QMOtEvwDpjjWMl7TV
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 2024-09-12_69362027900682e65ee6ce494906fed7_cryptolocker.exe -
Executes dropped EXE 1 IoCs
pid Process 3740 asih.exe -
resource yara_rule behavioral2/memory/2924-0-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral2/files/0x000800000002346b-13.dat upx behavioral2/memory/2924-17-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral2/memory/3740-26-0x0000000000500000-0x0000000000510000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-09-12_69362027900682e65ee6ce494906fed7_cryptolocker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language asih.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2924 wrote to memory of 3740 2924 2024-09-12_69362027900682e65ee6ce494906fed7_cryptolocker.exe 84 PID 2924 wrote to memory of 3740 2924 2024-09-12_69362027900682e65ee6ce494906fed7_cryptolocker.exe 84 PID 2924 wrote to memory of 3740 2924 2024-09-12_69362027900682e65ee6ce494906fed7_cryptolocker.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-12_69362027900682e65ee6ce494906fed7_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-12_69362027900682e65ee6ce494906fed7_cryptolocker.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3740
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD538352f4e8618ceffd30f37bfade16469
SHA148df4e5dc9a5293a13b19fb25b8dd784ae2ddeca
SHA256fd5aedcd1516942cac80800b2a05dab13a0add1ecaaa6bede28e21faa1f7dd20
SHA51275cecafc38cc2be04efa2fecacfd7161475b5e9001a63eaaed874073108ab664d9a81400b58949d3e128e2ebaf2b8ddaaaaad2bf9298c985f85f89d094ff7281