Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2024, 02:58
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-12_910a06f683042b87b138c588366c796a_cryptolocker.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-12_910a06f683042b87b138c588366c796a_cryptolocker.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-12_910a06f683042b87b138c588366c796a_cryptolocker.exe
-
Size
36KB
-
MD5
910a06f683042b87b138c588366c796a
-
SHA1
89ac2b3686b1a5e3d5628e62e1d4c84e02a69430
-
SHA256
fd7827f30a8ecd865583ebb5df0a1436c3c39be96f57c84aab91d979ad1fbee0
-
SHA512
972ae68cf2ba06281f0fb4cc49034e4642c232e36f4754af629e82f2d742f06b900e802b703bc3568639eda0d075ef15b932b16ab0cb86330ede032d893070d0
-
SSDEEP
384:btBYQg/WIEhUCSNyepEjYnDOAlzVol6U/zzo+tkq4l8tFFxE2BodcAOjbQ36ttTr:btB9g/WItCSsAGjX7r3BGub8Q
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 2024-10-12_910a06f683042b87b138c588366c796a_cryptolocker.exe -
Executes dropped EXE 1 IoCs
pid Process 4640 gewos.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-12_910a06f683042b87b138c588366c796a_cryptolocker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gewos.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 636 wrote to memory of 4640 636 2024-10-12_910a06f683042b87b138c588366c796a_cryptolocker.exe 84 PID 636 wrote to memory of 4640 636 2024-10-12_910a06f683042b87b138c588366c796a_cryptolocker.exe 84 PID 636 wrote to memory of 4640 636 2024-10-12_910a06f683042b87b138c588366c796a_cryptolocker.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-12_910a06f683042b87b138c588366c796a_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-12_910a06f683042b87b138c588366c796a_cryptolocker.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\gewos.exe"C:\Users\Admin\AppData\Local\Temp\gewos.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4640
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD592fa0f34a2305a3dc377085dd51c93c2
SHA166eee666f24321d957df3332fc3be276710623ab
SHA256005ee4d99e0477d4262112802c20b1274b8a2f0b160a5b635e58e4da83e693f0
SHA5122240f57ba85af4b7769426d98899a7c243eb3adf403c12776d628a788f99073ddc9b5735a667de1d87bed735e623ff2f3d1bc552eacd51676ee5f9283213b476