Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
12/10/2024, 03:13
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-12_b941e775587787950f2a8ff45e4a644c_cryptolocker.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-10-12_b941e775587787950f2a8ff45e4a644c_cryptolocker.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-12_b941e775587787950f2a8ff45e4a644c_cryptolocker.exe
-
Size
46KB
-
MD5
b941e775587787950f2a8ff45e4a644c
-
SHA1
71e309dbc78ec39af98b90eaf731d974d59aface
-
SHA256
27c5fd48da2ebc81ff9a466ea648c35b4013428bf80f31de5e8bb73af3df03cb
-
SHA512
2ba6d69bf036034bcb77917bac8c8cd23c620472204d9ae9c30d07ce15f4cf9736f6180be558cfbf3f64b856dd3ad925995324d02c60f479e7bcaeaa3a1509a2
-
SSDEEP
768:bao/2n1TCraU6GD1a4X1XOQ69zbjlAAX5e9zk:bF/y2lFizbR9Xwzk
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2908 rewok.exe -
Loads dropped DLL 1 IoCs
pid Process 2852 2024-10-12_b941e775587787950f2a8ff45e4a644c_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-12_b941e775587787950f2a8ff45e4a644c_cryptolocker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rewok.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2852 2024-10-12_b941e775587787950f2a8ff45e4a644c_cryptolocker.exe 2908 rewok.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2852 wrote to memory of 2908 2852 2024-10-12_b941e775587787950f2a8ff45e4a644c_cryptolocker.exe 30 PID 2852 wrote to memory of 2908 2852 2024-10-12_b941e775587787950f2a8ff45e4a644c_cryptolocker.exe 30 PID 2852 wrote to memory of 2908 2852 2024-10-12_b941e775587787950f2a8ff45e4a644c_cryptolocker.exe 30 PID 2852 wrote to memory of 2908 2852 2024-10-12_b941e775587787950f2a8ff45e4a644c_cryptolocker.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-12_b941e775587787950f2a8ff45e4a644c_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-12_b941e775587787950f2a8ff45e4a644c_cryptolocker.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\rewok.exe"C:\Users\Admin\AppData\Local\Temp\rewok.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
PID:2908
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD5cb9a6a6ccab5108a7ef8e6f608c89127
SHA113ce33fe6d820c091400dd5002c49d6e21690840
SHA256cbb04cccc31d8b6105329f30cfac9dce0a8280c24dd85c5b5490a9e34e15271d
SHA512b6128b6f682a57b4353e68ae1a405bf483b4c1cd63ca1c6d6b4e60a28b699433bea52e6f20176b5ab9425fa12e67630ec7a10de5df5bea3752da2a31934a296b