Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    05/08/2023, 13:25

General

  • Target

    718538165ac24648d871046b5703743a_cryptolocker_JC.exe

  • Size

    70KB

  • MD5

    718538165ac24648d871046b5703743a

  • SHA1

    b120e97cdc1b2d1b0dcdbe65f348f35e9c18bc52

  • SHA256

    f2c170b062f67bd4f11cd82e48a787c760fbd661012de5cce6dc85ad8cc14ec6

  • SHA512

    7ad129b380da003eb36ed40ddcac4b9d209b32c0a06637727a4b4a1955b8c74917f5314e610fe48e54b6e26a4eb2398366a54ecdf3a5a5dd7040850de538e7bc

  • SSDEEP

    768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZ7uyA36S7MzInb9VG4k:xj+VGMOtEvwDpjubwQE1dk

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\718538165ac24648d871046b5703743a_cryptolocker_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\718538165ac24648d871046b5703743a_cryptolocker_JC.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1996
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Executes dropped EXE
      PID:1436

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    70KB

    MD5

    33d571c1a012d5fe3374826a05e7e37e

    SHA1

    8e807ebf6c86b6b6e74fb6f2a592caa38a781654

    SHA256

    2acb52c5b22480dcf40e3120437f40111ef7a4998a9714bb4e28c50a9c7d3f23

    SHA512

    d9bee3357da3805139aa1726a1528cedf40acef926e20542b6f9fe283c6c64d68d50ec81098abd4035018a9db2c882e5c8926b27ba89d7298ecb0846d5bdf0af

  • C:\Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    70KB

    MD5

    33d571c1a012d5fe3374826a05e7e37e

    SHA1

    8e807ebf6c86b6b6e74fb6f2a592caa38a781654

    SHA256

    2acb52c5b22480dcf40e3120437f40111ef7a4998a9714bb4e28c50a9c7d3f23

    SHA512

    d9bee3357da3805139aa1726a1528cedf40acef926e20542b6f9fe283c6c64d68d50ec81098abd4035018a9db2c882e5c8926b27ba89d7298ecb0846d5bdf0af

  • \Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    70KB

    MD5

    33d571c1a012d5fe3374826a05e7e37e

    SHA1

    8e807ebf6c86b6b6e74fb6f2a592caa38a781654

    SHA256

    2acb52c5b22480dcf40e3120437f40111ef7a4998a9714bb4e28c50a9c7d3f23

    SHA512

    d9bee3357da3805139aa1726a1528cedf40acef926e20542b6f9fe283c6c64d68d50ec81098abd4035018a9db2c882e5c8926b27ba89d7298ecb0846d5bdf0af

  • memory/1436-73-0x00000000004E0000-0x00000000004E6000-memory.dmp

    Filesize

    24KB

  • memory/1436-70-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/1436-72-0x0000000000600000-0x0000000000606000-memory.dmp

    Filesize

    24KB

  • memory/1436-80-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/1996-55-0x0000000000330000-0x0000000000336000-memory.dmp

    Filesize

    24KB

  • memory/1996-56-0x0000000000360000-0x0000000000366000-memory.dmp

    Filesize

    24KB

  • memory/1996-68-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/1996-65-0x0000000001F60000-0x0000000001F70000-memory.dmp

    Filesize

    64KB

  • memory/1996-0-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/1996-54-0x0000000000330000-0x0000000000336000-memory.dmp

    Filesize

    24KB