Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
01/08/2023, 14:52
Static task
static1
Behavioral task
behavioral1
Sample
28d613ce9c49eb74e8450e23c13ebf4c_cryptolocker_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
28d613ce9c49eb74e8450e23c13ebf4c_cryptolocker_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
28d613ce9c49eb74e8450e23c13ebf4c_cryptolocker_JC.exe
-
Size
42KB
-
MD5
28d613ce9c49eb74e8450e23c13ebf4c
-
SHA1
d7bc4a161cb58014c2e92d550132839f684c8b1a
-
SHA256
b1dcbba8a7b00a3a5e753d86ffee4b7ca8aac6101aa3ef2819dde340d3fbcac7
-
SHA512
f66eefad532ca37201265ce980784f37e336c2aada79394c15883620d7306f7130e544b43190ed491ff4fba08bf46b100f7a655469768119e3896eb9038e5443
-
SSDEEP
768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4/Uth8igNrNEb:vj+jsMQMOtEvwDpj5HczerNEb
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1420 misid.exe -
Loads dropped DLL 1 IoCs
pid Process 1508 28d613ce9c49eb74e8450e23c13ebf4c_cryptolocker_JC.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1508 wrote to memory of 1420 1508 28d613ce9c49eb74e8450e23c13ebf4c_cryptolocker_JC.exe 28 PID 1508 wrote to memory of 1420 1508 28d613ce9c49eb74e8450e23c13ebf4c_cryptolocker_JC.exe 28 PID 1508 wrote to memory of 1420 1508 28d613ce9c49eb74e8450e23c13ebf4c_cryptolocker_JC.exe 28 PID 1508 wrote to memory of 1420 1508 28d613ce9c49eb74e8450e23c13ebf4c_cryptolocker_JC.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\28d613ce9c49eb74e8450e23c13ebf4c_cryptolocker_JC.exe"C:\Users\Admin\AppData\Local\Temp\28d613ce9c49eb74e8450e23c13ebf4c_cryptolocker_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
PID:1420
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5f258b67f93e3e9c79fb001c3a935acd1
SHA15d91a1270a26b49bc7d8faf6e2dde5fb70c5d35f
SHA256f98baafb0efe907d5a7204e23c79319636976bdd54d8c67b7681ba971bb60f4c
SHA512e39b1a3e36e37ae9f2af6acbe2bf3ded36d10f592df4c7f6f1b1e3c1c4fa34a85de1f1d8d6e3d688d47c12c65db3942af8d5a949a436cf6060db362ebd9bef0c
-
Filesize
42KB
MD5f258b67f93e3e9c79fb001c3a935acd1
SHA15d91a1270a26b49bc7d8faf6e2dde5fb70c5d35f
SHA256f98baafb0efe907d5a7204e23c79319636976bdd54d8c67b7681ba971bb60f4c
SHA512e39b1a3e36e37ae9f2af6acbe2bf3ded36d10f592df4c7f6f1b1e3c1c4fa34a85de1f1d8d6e3d688d47c12c65db3942af8d5a949a436cf6060db362ebd9bef0c
-
Filesize
42KB
MD5f258b67f93e3e9c79fb001c3a935acd1
SHA15d91a1270a26b49bc7d8faf6e2dde5fb70c5d35f
SHA256f98baafb0efe907d5a7204e23c79319636976bdd54d8c67b7681ba971bb60f4c
SHA512e39b1a3e36e37ae9f2af6acbe2bf3ded36d10f592df4c7f6f1b1e3c1c4fa34a85de1f1d8d6e3d688d47c12c65db3942af8d5a949a436cf6060db362ebd9bef0c