Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
25/09/2024, 03:43
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-25_b1b5407112625b3e70b4daed8ac43073_cryptolocker.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-09-25_b1b5407112625b3e70b4daed8ac43073_cryptolocker.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-25_b1b5407112625b3e70b4daed8ac43073_cryptolocker.exe
-
Size
44KB
-
MD5
b1b5407112625b3e70b4daed8ac43073
-
SHA1
5e4b420d92b95dcdc3b6fbaa27d4c8277aa44444
-
SHA256
f7ca6a4cc4f31cf0a2bce1e2c3fc81eeb3ed11b29143c75d61a3702169275f9c
-
SHA512
a57c91cdb050f00fa398638220e027b6d0ecb0669e22c574a5018d038d7ef25d720a4812602c0b45f235c4a1f44185f522aeb5ac420fa09110495035f179c748
-
SSDEEP
768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6WaJIOc+UPPEkL7vF1TS:YGzl5wjRQBBOsP1QMOtEvwDpjgarrkLS
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2200 asih.exe -
Loads dropped DLL 1 IoCs
pid Process 2416 2024-09-25_b1b5407112625b3e70b4daed8ac43073_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-09-25_b1b5407112625b3e70b4daed8ac43073_cryptolocker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language asih.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2416 wrote to memory of 2200 2416 2024-09-25_b1b5407112625b3e70b4daed8ac43073_cryptolocker.exe 30 PID 2416 wrote to memory of 2200 2416 2024-09-25_b1b5407112625b3e70b4daed8ac43073_cryptolocker.exe 30 PID 2416 wrote to memory of 2200 2416 2024-09-25_b1b5407112625b3e70b4daed8ac43073_cryptolocker.exe 30 PID 2416 wrote to memory of 2200 2416 2024-09-25_b1b5407112625b3e70b4daed8ac43073_cryptolocker.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-25_b1b5407112625b3e70b4daed8ac43073_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-25_b1b5407112625b3e70b4daed8ac43073_cryptolocker.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2200
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44KB
MD51ca58fc17b069ff8434c7470eca56525
SHA1d2478fd92a34f3185a8e38c269e28ec9b9692486
SHA256710f6732b04dd87e2afbc6192738a23193f6e51ef983a7a862186d06d69187fe
SHA5129960818557394f5e688f3561d17c77a93829928f02f2888d0331cc85b2fda1b2e00a0de0ca464e3542471961a0df01957bc39ce4b36c84c74edaf9218a0a2479