Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
12/10/2024, 02:58
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-12_92890a54d0da70049c2ec1cb38ec8686_cryptolocker.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-10-12_92890a54d0da70049c2ec1cb38ec8686_cryptolocker.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-12_92890a54d0da70049c2ec1cb38ec8686_cryptolocker.exe
-
Size
73KB
-
MD5
92890a54d0da70049c2ec1cb38ec8686
-
SHA1
4ae1c5c36f56f32696c0883349c9fac8f1be3054
-
SHA256
e92c84210295585d1408c86693f1424ede5026292b61f4cd3c6b3da293828f8c
-
SHA512
00b80be2655a1dd863cd24cbb19eae78953094926872f596b74b239ebaf6ccb383187df20e11fe738233b610cb6df2b466461a1954f718615e2b859e0bd7d922
-
SSDEEP
768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4ZPsED3VK2+ZtyOjgO4r9vFAg2rq2g1B/Re:vj+jsMQMOtEvwDpj5HZYTjipvF24nW
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2472 misid.exe -
Loads dropped DLL 1 IoCs
pid Process 1976 2024-10-12_92890a54d0da70049c2ec1cb38ec8686_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-12_92890a54d0da70049c2ec1cb38ec8686_cryptolocker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language misid.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1976 wrote to memory of 2472 1976 2024-10-12_92890a54d0da70049c2ec1cb38ec8686_cryptolocker.exe 31 PID 1976 wrote to memory of 2472 1976 2024-10-12_92890a54d0da70049c2ec1cb38ec8686_cryptolocker.exe 31 PID 1976 wrote to memory of 2472 1976 2024-10-12_92890a54d0da70049c2ec1cb38ec8686_cryptolocker.exe 31 PID 1976 wrote to memory of 2472 1976 2024-10-12_92890a54d0da70049c2ec1cb38ec8686_cryptolocker.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-12_92890a54d0da70049c2ec1cb38ec8686_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-12_92890a54d0da70049c2ec1cb38ec8686_cryptolocker.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2472
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD5d527bd3444d15567e70ce0d6fb82541f
SHA17272418132ef16c40d37d6338c351aecb23ad2de
SHA25628cdbc3a0ead8aae911fa1cd2a59ad02b96a9afddf1a373a753327fcdc9637dc
SHA5127a8b791c861270ebe0935c1b23856541708b251e379dc2de40460104feafb60dfc4db97bb3373837572aab2e1cf1f67b3224281ea673ee034cc71ab17fe256f7