Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
18/10/2024, 03:33
Behavioral task
behavioral1
Sample
2024-10-18_295cf4d26e1171b5d8de0b7ccc4e7bc6_cryptolocker.exe
Resource
win7-20240708-en
General
-
Target
2024-10-18_295cf4d26e1171b5d8de0b7ccc4e7bc6_cryptolocker.exe
-
Size
79KB
-
MD5
295cf4d26e1171b5d8de0b7ccc4e7bc6
-
SHA1
57224da8fbf03d6a16d72cd3c8b02e5ab9cef45d
-
SHA256
ab0168b60655c99acbb3005b0d804284a7ed18afd53cccc6ff8e8f7be905de3e
-
SHA512
d65eae32e9fe4f9535dc73d6fc96ec302c3f4ce4ae5daaea5165b4ac139653a4621157986b28ba1c5095e36d6ee74362b2907c64d3d04a910266fa0c53305489
-
SSDEEP
1536:T6QFElP6n+gxmddpMOtEvwDpjwaxTNUOAkXtBdxPUx4:T6a+rdOOtEvwDpjNtHPH
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1864 asih.exe -
Loads dropped DLL 1 IoCs
pid Process 2272 2024-10-18_295cf4d26e1171b5d8de0b7ccc4e7bc6_cryptolocker.exe -
resource yara_rule behavioral1/memory/2272-0-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/files/0x000a0000000122f6-11.dat upx behavioral1/memory/2272-16-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/memory/1864-17-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/memory/1864-27-0x0000000000500000-0x0000000000510000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-18_295cf4d26e1171b5d8de0b7ccc4e7bc6_cryptolocker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language asih.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2272 wrote to memory of 1864 2272 2024-10-18_295cf4d26e1171b5d8de0b7ccc4e7bc6_cryptolocker.exe 31 PID 2272 wrote to memory of 1864 2272 2024-10-18_295cf4d26e1171b5d8de0b7ccc4e7bc6_cryptolocker.exe 31 PID 2272 wrote to memory of 1864 2272 2024-10-18_295cf4d26e1171b5d8de0b7ccc4e7bc6_cryptolocker.exe 31 PID 2272 wrote to memory of 1864 2272 2024-10-18_295cf4d26e1171b5d8de0b7ccc4e7bc6_cryptolocker.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-18_295cf4d26e1171b5d8de0b7ccc4e7bc6_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-18_295cf4d26e1171b5d8de0b7ccc4e7bc6_cryptolocker.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1864
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
79KB
MD57d485fec148d0ddc796d0686b7de30a3
SHA1f48ecccf268d514a78e505ac48b80c6609531c0f
SHA256f4ccdc0674a401a6789bbc4b0f33a87bd880b9e0e0ed935b772b1dec234faa0d
SHA512d85410c54321b3c30f1ff7e8f8991645d98d7c4471e96eceeef858bd9483d088d85761cc53b4db6d6f470f2535b2456cb2af61c7d3b3ac47890d4e02220021be