Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    128s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/08/2023, 13:25

General

  • Target

    718538165ac24648d871046b5703743a_cryptolocker_JC.exe

  • Size

    70KB

  • MD5

    718538165ac24648d871046b5703743a

  • SHA1

    b120e97cdc1b2d1b0dcdbe65f348f35e9c18bc52

  • SHA256

    f2c170b062f67bd4f11cd82e48a787c760fbd661012de5cce6dc85ad8cc14ec6

  • SHA512

    7ad129b380da003eb36ed40ddcac4b9d209b32c0a06637727a4b4a1955b8c74917f5314e610fe48e54b6e26a4eb2398366a54ecdf3a5a5dd7040850de538e7bc

  • SSDEEP

    768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZ7uyA36S7MzInb9VG4k:xj+VGMOtEvwDpjubwQE1dk

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\718538165ac24648d871046b5703743a_cryptolocker_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\718538165ac24648d871046b5703743a_cryptolocker_JC.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4768
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      PID:3300

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    70KB

    MD5

    33d571c1a012d5fe3374826a05e7e37e

    SHA1

    8e807ebf6c86b6b6e74fb6f2a592caa38a781654

    SHA256

    2acb52c5b22480dcf40e3120437f40111ef7a4998a9714bb4e28c50a9c7d3f23

    SHA512

    d9bee3357da3805139aa1726a1528cedf40acef926e20542b6f9fe283c6c64d68d50ec81098abd4035018a9db2c882e5c8926b27ba89d7298ecb0846d5bdf0af

  • C:\Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    70KB

    MD5

    33d571c1a012d5fe3374826a05e7e37e

    SHA1

    8e807ebf6c86b6b6e74fb6f2a592caa38a781654

    SHA256

    2acb52c5b22480dcf40e3120437f40111ef7a4998a9714bb4e28c50a9c7d3f23

    SHA512

    d9bee3357da3805139aa1726a1528cedf40acef926e20542b6f9fe283c6c64d68d50ec81098abd4035018a9db2c882e5c8926b27ba89d7298ecb0846d5bdf0af

  • C:\Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    70KB

    MD5

    33d571c1a012d5fe3374826a05e7e37e

    SHA1

    8e807ebf6c86b6b6e74fb6f2a592caa38a781654

    SHA256

    2acb52c5b22480dcf40e3120437f40111ef7a4998a9714bb4e28c50a9c7d3f23

    SHA512

    d9bee3357da3805139aa1726a1528cedf40acef926e20542b6f9fe283c6c64d68d50ec81098abd4035018a9db2c882e5c8926b27ba89d7298ecb0846d5bdf0af

  • C:\Users\Admin\AppData\Local\Temp\misids.exe

    Filesize

    315B

    MD5

    a34ac19f4afae63adc5d2f7bc970c07f

    SHA1

    a82190fc530c265aa40a045c21770d967f4767b8

    SHA256

    d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

    SHA512

    42e53d96e5961e95b7a984d9c9778a1d3bd8ee0c87b8b3b515fa31f67c2d073c8565afc2f4b962c43668c4efa1e478da9bb0ecffa79479c7e880731bc4c55765

  • memory/3300-154-0x0000000000520000-0x0000000000526000-memory.dmp

    Filesize

    24KB

  • memory/3300-150-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/3300-153-0x0000000001F70000-0x0000000001F76000-memory.dmp

    Filesize

    24KB

  • memory/3300-182-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/4768-136-0x0000000002040000-0x0000000002046000-memory.dmp

    Filesize

    24KB

  • memory/4768-135-0x00000000021D0000-0x00000000021D6000-memory.dmp

    Filesize

    24KB

  • memory/4768-151-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/4768-133-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/4768-134-0x00000000021D0000-0x00000000021D6000-memory.dmp

    Filesize

    24KB