Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/10/2024, 16:32
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-10_62f122ce78c25ef8be32c233766d99b8_cryptolocker.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-10-10_62f122ce78c25ef8be32c233766d99b8_cryptolocker.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-10_62f122ce78c25ef8be32c233766d99b8_cryptolocker.exe
-
Size
31KB
-
MD5
62f122ce78c25ef8be32c233766d99b8
-
SHA1
f6c0159df5ef7aff13e8c8062a590f52327ac775
-
SHA256
5ac783aad87b804a8dc8e2a9507c14607c67beded2d9bb4a2d286c39ada8100f
-
SHA512
751bb4ba44e7e0c5fc91b5299ecaf3e08a08b5df920fc8fc72c1fb28e8a312f13b7afbc3a2cd78ecd650707f93e60177fbc412ab7c37c6cc99bc087536d45cb7
-
SSDEEP
384:bmM0V/YPvnr801TRoUGPh4TKt6ATt1DqgPa3s/zzo984:b7o/2n1TCraU6GD1a4XD4
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation 2024-10-10_62f122ce78c25ef8be32c233766d99b8_cryptolocker.exe -
Executes dropped EXE 1 IoCs
pid Process 1220 rewok.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-10_62f122ce78c25ef8be32c233766d99b8_cryptolocker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rewok.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2964 wrote to memory of 1220 2964 2024-10-10_62f122ce78c25ef8be32c233766d99b8_cryptolocker.exe 85 PID 2964 wrote to memory of 1220 2964 2024-10-10_62f122ce78c25ef8be32c233766d99b8_cryptolocker.exe 85 PID 2964 wrote to memory of 1220 2964 2024-10-10_62f122ce78c25ef8be32c233766d99b8_cryptolocker.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-10_62f122ce78c25ef8be32c233766d99b8_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-10_62f122ce78c25ef8be32c233766d99b8_cryptolocker.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\rewok.exe"C:\Users\Admin\AppData\Local\Temp\rewok.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1220
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD51a4e50008983161f3f4a040dc818c7db
SHA1400527dd3527d3e42941e3e57252aaa1d9cd2114
SHA25665fa2d50d13c009d1ae56ece3d73f7759f92c2b492d00272c3c3ec2d7dc0957a
SHA512be44be652c501736837fd6dfc6db392bc216867f8a12a5e56401193e5b3f0219e5d9bf73f873c959bd4b76d43f748a7c5447e838c57cfd120a22908a7794e7e3