Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    03/08/2023, 15:30

General

  • Target

    49bcb0b66f700cad28bcc7a1c9ad6df9_cryptolocker_JC.exe

  • Size

    97KB

  • MD5

    49bcb0b66f700cad28bcc7a1c9ad6df9

  • SHA1

    10c191f385d97b6a19894302bb83c998a35c20db

  • SHA256

    7a116d72e74bbde4801ef840acd0c0ce02e0e08d8010cb189b24518b6df2c2c2

  • SHA512

    cba19d8e6e54da51bfcbc7716b605d58555ff04d7796bc9468295ed240f91e2c950c4606fb77e384b343d156f23e897c69445d9c5ceaeaa95426756d0b7a5aee

  • SSDEEP

    1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgpQbCJjMcd:AnBdOOtEvwDpj6zU

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\49bcb0b66f700cad28bcc7a1c9ad6df9_cryptolocker_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\49bcb0b66f700cad28bcc7a1c9ad6df9_cryptolocker_JC.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2216
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:2308

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    98KB

    MD5

    fe060b329f83e705ef5db303d7d911a9

    SHA1

    a40c2c2d19fe94f6ab516fea5b12a543e4338389

    SHA256

    ea596aef02f58f0b5f6881ffc99e0d0baa84e4f1748581303357d80ced3da504

    SHA512

    04639d36cc79c98de0bfb906f37b05401217b9741ea07d1e24be8160b2add5551df6334816373d95ae133b9fd04762519af010c24c557029a17341aaebf50bca

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    98KB

    MD5

    fe060b329f83e705ef5db303d7d911a9

    SHA1

    a40c2c2d19fe94f6ab516fea5b12a543e4338389

    SHA256

    ea596aef02f58f0b5f6881ffc99e0d0baa84e4f1748581303357d80ced3da504

    SHA512

    04639d36cc79c98de0bfb906f37b05401217b9741ea07d1e24be8160b2add5551df6334816373d95ae133b9fd04762519af010c24c557029a17341aaebf50bca

  • \Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    98KB

    MD5

    fe060b329f83e705ef5db303d7d911a9

    SHA1

    a40c2c2d19fe94f6ab516fea5b12a543e4338389

    SHA256

    ea596aef02f58f0b5f6881ffc99e0d0baa84e4f1748581303357d80ced3da504

    SHA512

    04639d36cc79c98de0bfb906f37b05401217b9741ea07d1e24be8160b2add5551df6334816373d95ae133b9fd04762519af010c24c557029a17341aaebf50bca

  • memory/2216-54-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/2216-56-0x0000000000450000-0x0000000000456000-memory.dmp

    Filesize

    24KB

  • memory/2216-55-0x0000000000320000-0x0000000000326000-memory.dmp

    Filesize

    24KB

  • memory/2216-58-0x0000000000320000-0x0000000000326000-memory.dmp

    Filesize

    24KB

  • memory/2216-67-0x00000000024C0000-0x00000000024CF000-memory.dmp

    Filesize

    60KB

  • memory/2216-69-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/2308-73-0x0000000000490000-0x0000000000496000-memory.dmp

    Filesize

    24KB

  • memory/2308-72-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2308-80-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB