Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
18/10/2024, 03:53 UTC
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-18_8883063ba23d6acaae9b279e3e94166b_cryptolocker.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-10-18_8883063ba23d6acaae9b279e3e94166b_cryptolocker.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-18_8883063ba23d6acaae9b279e3e94166b_cryptolocker.exe
-
Size
46KB
-
MD5
8883063ba23d6acaae9b279e3e94166b
-
SHA1
9ea880921666ee4ce564970bdf15c3d575973e89
-
SHA256
8f637ffdcd465818b8d4999d682dd1d3572bab8468b51e41fa21c01e87b86991
-
SHA512
1829e2e22e5be3c884a31a97cb1889c79e442773c135bb6d3dd08e2a8c3c94f19e0197b7f4428a869495184bd17a2a9caaaa55cabf4c9a3669c1ca64be1afd34
-
SSDEEP
768:bao/2n1TCraU6GD1a4X1XOQ69zbjlAAX5e9zQ:bF/y2lFizbR9XwzQ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2804 rewok.exe -
Loads dropped DLL 1 IoCs
pid Process 3020 2024-10-18_8883063ba23d6acaae9b279e3e94166b_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-18_8883063ba23d6acaae9b279e3e94166b_cryptolocker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rewok.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 3020 2024-10-18_8883063ba23d6acaae9b279e3e94166b_cryptolocker.exe 2804 rewok.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3020 wrote to memory of 2804 3020 2024-10-18_8883063ba23d6acaae9b279e3e94166b_cryptolocker.exe 30 PID 3020 wrote to memory of 2804 3020 2024-10-18_8883063ba23d6acaae9b279e3e94166b_cryptolocker.exe 30 PID 3020 wrote to memory of 2804 3020 2024-10-18_8883063ba23d6acaae9b279e3e94166b_cryptolocker.exe 30 PID 3020 wrote to memory of 2804 3020 2024-10-18_8883063ba23d6acaae9b279e3e94166b_cryptolocker.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-18_8883063ba23d6acaae9b279e3e94166b_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-18_8883063ba23d6acaae9b279e3e94166b_cryptolocker.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\rewok.exe"C:\Users\Admin\AppData\Local\Temp\rewok.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
PID:2804
-
Network
-
Remote address:8.8.8.8:53Requestspinistry.comIN AResponsespinistry.comIN A64.98.135.121
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
52 B 1
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD5031517fcfe90e59f8f168c2ecd037d5c
SHA130e36fa997757ae3c8cd66097610ea34aea34b39
SHA2560d7949fc199dbe32dab3e0baf168da97ee1a72c109708e032edb8f5171226e08
SHA512af9192d00202da01c08cb1f6029ede60f844737a67ab7be0322262ce0a1771d2b0852779946e6955d884e1e5c79994bb4398214dd6e83897a98cfd89e87f8fd8