Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
05/08/2023, 13:18
Behavioral task
behavioral1
Sample
70d1e9277f2fe2f2423d764ebaf4d98c_cryptolocker_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
70d1e9277f2fe2f2423d764ebaf4d98c_cryptolocker_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
70d1e9277f2fe2f2423d764ebaf4d98c_cryptolocker_JC.exe
-
Size
98KB
-
MD5
70d1e9277f2fe2f2423d764ebaf4d98c
-
SHA1
3ef8ccf336decf5a8a314174351001f504bd8b9d
-
SHA256
0fa8410efd7e7ebe35a734fb726839f59b101397d01f2cd0548f80cd3e9bc629
-
SHA512
35c811d33feeafbfa53982523535b82bf34c0ab929ce3e68ab43fa37d9f0ad862b4443caaa68dc9e3ae1a3c85bcdba27a9503bfe36c103c9f3c9e7e9d9f8945e
-
SSDEEP
1536:P8mnK6QFElP6n+gymddpMOtEvwDpjIHsalRn5iF1j6GQi:1nK6a+qdOOtEvwDpjL
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 868 asih.exe -
Loads dropped DLL 1 IoCs
pid Process 1624 70d1e9277f2fe2f2423d764ebaf4d98c_cryptolocker_JC.exe -
resource yara_rule behavioral1/memory/1624-54-0x0000000000500000-0x000000000050F311-memory.dmp upx behavioral1/files/0x0007000000012107-65.dat upx behavioral1/memory/1624-66-0x0000000000650000-0x0000000000660000-memory.dmp upx behavioral1/memory/1624-70-0x0000000000500000-0x000000000050F311-memory.dmp upx behavioral1/files/0x0007000000012107-69.dat upx behavioral1/memory/868-72-0x0000000000500000-0x000000000050F311-memory.dmp upx behavioral1/files/0x0007000000012107-80.dat upx behavioral1/memory/868-82-0x0000000000500000-0x000000000050F311-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1624 wrote to memory of 868 1624 70d1e9277f2fe2f2423d764ebaf4d98c_cryptolocker_JC.exe 28 PID 1624 wrote to memory of 868 1624 70d1e9277f2fe2f2423d764ebaf4d98c_cryptolocker_JC.exe 28 PID 1624 wrote to memory of 868 1624 70d1e9277f2fe2f2423d764ebaf4d98c_cryptolocker_JC.exe 28 PID 1624 wrote to memory of 868 1624 70d1e9277f2fe2f2423d764ebaf4d98c_cryptolocker_JC.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\70d1e9277f2fe2f2423d764ebaf4d98c_cryptolocker_JC.exe"C:\Users\Admin\AppData\Local\Temp\70d1e9277f2fe2f2423d764ebaf4d98c_cryptolocker_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
PID:868
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
98KB
MD593208ca7b254dc948e02dbb119856858
SHA12fe9a7357f2a18fa9b10590a72ad7f07446eed2e
SHA256e2d53f3546ad45e2ff9515d487fdb37c037cf3e8126c0207ffbff20ad85800d7
SHA51203db13b61998e8e04496573c7237de46bf2782fb74af5ca7cd5c8b0bb8d85f1a56744529d1651e6a32c8199051412eddc99526d4fcc9c6952490fffd87ee8d34
-
Filesize
98KB
MD593208ca7b254dc948e02dbb119856858
SHA12fe9a7357f2a18fa9b10590a72ad7f07446eed2e
SHA256e2d53f3546ad45e2ff9515d487fdb37c037cf3e8126c0207ffbff20ad85800d7
SHA51203db13b61998e8e04496573c7237de46bf2782fb74af5ca7cd5c8b0bb8d85f1a56744529d1651e6a32c8199051412eddc99526d4fcc9c6952490fffd87ee8d34
-
Filesize
98KB
MD593208ca7b254dc948e02dbb119856858
SHA12fe9a7357f2a18fa9b10590a72ad7f07446eed2e
SHA256e2d53f3546ad45e2ff9515d487fdb37c037cf3e8126c0207ffbff20ad85800d7
SHA51203db13b61998e8e04496573c7237de46bf2782fb74af5ca7cd5c8b0bb8d85f1a56744529d1651e6a32c8199051412eddc99526d4fcc9c6952490fffd87ee8d34