Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/10/2024, 02:58
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-12_910a06f683042b87b138c588366c796a_cryptolocker.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-12_910a06f683042b87b138c588366c796a_cryptolocker.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-12_910a06f683042b87b138c588366c796a_cryptolocker.exe
-
Size
36KB
-
MD5
910a06f683042b87b138c588366c796a
-
SHA1
89ac2b3686b1a5e3d5628e62e1d4c84e02a69430
-
SHA256
fd7827f30a8ecd865583ebb5df0a1436c3c39be96f57c84aab91d979ad1fbee0
-
SHA512
972ae68cf2ba06281f0fb4cc49034e4642c232e36f4754af629e82f2d742f06b900e802b703bc3568639eda0d075ef15b932b16ab0cb86330ede032d893070d0
-
SSDEEP
384:btBYQg/WIEhUCSNyepEjYnDOAlzVol6U/zzo+tkq4l8tFFxE2BodcAOjbQ36ttTr:btB9g/WItCSsAGjX7r3BGub8Q
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2788 gewos.exe -
Loads dropped DLL 1 IoCs
pid Process 3068 2024-10-12_910a06f683042b87b138c588366c796a_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-12_910a06f683042b87b138c588366c796a_cryptolocker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gewos.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 3068 2024-10-12_910a06f683042b87b138c588366c796a_cryptolocker.exe 2788 gewos.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3068 wrote to memory of 2788 3068 2024-10-12_910a06f683042b87b138c588366c796a_cryptolocker.exe 30 PID 3068 wrote to memory of 2788 3068 2024-10-12_910a06f683042b87b138c588366c796a_cryptolocker.exe 30 PID 3068 wrote to memory of 2788 3068 2024-10-12_910a06f683042b87b138c588366c796a_cryptolocker.exe 30 PID 3068 wrote to memory of 2788 3068 2024-10-12_910a06f683042b87b138c588366c796a_cryptolocker.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-12_910a06f683042b87b138c588366c796a_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-12_910a06f683042b87b138c588366c796a_cryptolocker.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\gewos.exe"C:\Users\Admin\AppData\Local\Temp\gewos.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
PID:2788
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD592fa0f34a2305a3dc377085dd51c93c2
SHA166eee666f24321d957df3332fc3be276710623ab
SHA256005ee4d99e0477d4262112802c20b1274b8a2f0b160a5b635e58e4da83e693f0
SHA5122240f57ba85af4b7769426d98899a7c243eb3adf403c12776d628a788f99073ddc9b5735a667de1d87bed735e623ff2f3d1bc552eacd51676ee5f9283213b476