Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    127s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/08/2023, 14:42

General

  • Target

    57ff2db9e34446b11f584e84369f5b60_cryptolocker_JC.exe

  • Size

    74KB

  • MD5

    57ff2db9e34446b11f584e84369f5b60

  • SHA1

    418189bf9d2b58fa194b51c1598c0e9bcb932275

  • SHA256

    e1887f3717fe3088e78b57f1bee69c9d4eeb9d3190437d8e10bbc1d1c42e610c

  • SHA512

    3fb171d71bff309015d1b9f3ba14e03a950023cfff25956171234baf72af8fab365e2b483f10429513d60a009f095beed48b7688a5e8b55f6c0230cfa2e84b21

  • SSDEEP

    1536:ZzFbxmLPWQMOtEvwDpj386Sj/WprgJNpsAnJYqdIRAc3:ZVxkGOtEvwDpjcNY

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\57ff2db9e34446b11f584e84369f5b60_cryptolocker_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\57ff2db9e34446b11f584e84369f5b60_cryptolocker_JC.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1928
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      PID:3164

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    74KB

    MD5

    f03bd318da8adc6b14f4a335fd7fa142

    SHA1

    3205b64076eb6e463b80a452eadebf1f57452358

    SHA256

    b3de65dbfcce38c12d792e7a28c2cb03d130c80f8d26e22237ac30ac94d44df0

    SHA512

    f9fee1c5a2dec189c8eea9514cee1dcf7c0b4213b94dc43240510206a3075251b7589246f7205da87b1191f56b08b8dfba4ad145308ad8ffeb3440187c1a6c3d

  • C:\Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    74KB

    MD5

    f03bd318da8adc6b14f4a335fd7fa142

    SHA1

    3205b64076eb6e463b80a452eadebf1f57452358

    SHA256

    b3de65dbfcce38c12d792e7a28c2cb03d130c80f8d26e22237ac30ac94d44df0

    SHA512

    f9fee1c5a2dec189c8eea9514cee1dcf7c0b4213b94dc43240510206a3075251b7589246f7205da87b1191f56b08b8dfba4ad145308ad8ffeb3440187c1a6c3d

  • C:\Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    74KB

    MD5

    f03bd318da8adc6b14f4a335fd7fa142

    SHA1

    3205b64076eb6e463b80a452eadebf1f57452358

    SHA256

    b3de65dbfcce38c12d792e7a28c2cb03d130c80f8d26e22237ac30ac94d44df0

    SHA512

    f9fee1c5a2dec189c8eea9514cee1dcf7c0b4213b94dc43240510206a3075251b7589246f7205da87b1191f56b08b8dfba4ad145308ad8ffeb3440187c1a6c3d

  • C:\Users\Admin\AppData\Local\Temp\misids.exe

    Filesize

    315B

    MD5

    a34ac19f4afae63adc5d2f7bc970c07f

    SHA1

    a82190fc530c265aa40a045c21770d967f4767b8

    SHA256

    d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

    SHA512

    42e53d96e5961e95b7a984d9c9778a1d3bd8ee0c87b8b3b515fa31f67c2d073c8565afc2f4b962c43668c4efa1e478da9bb0ecffa79479c7e880731bc4c55765

  • memory/1928-133-0x00000000004E0000-0x00000000004E3000-memory.dmp

    Filesize

    12KB

  • memory/1928-134-0x0000000000520000-0x0000000000526000-memory.dmp

    Filesize

    24KB

  • memory/1928-135-0x0000000000520000-0x0000000000526000-memory.dmp

    Filesize

    24KB

  • memory/1928-136-0x00000000021B0000-0x00000000021B6000-memory.dmp

    Filesize

    24KB

  • memory/1928-150-0x00000000004E0000-0x00000000004E3000-memory.dmp

    Filesize

    12KB

  • memory/3164-153-0x0000000002000000-0x0000000002006000-memory.dmp

    Filesize

    24KB

  • memory/3164-152-0x0000000001FD0000-0x0000000001FD6000-memory.dmp

    Filesize

    24KB