Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/08/2023, 10:39

General

  • Target

    80b019780e0d730bf212487a3260f8cd_cryptolocker_JC.exe

  • Size

    30KB

  • MD5

    80b019780e0d730bf212487a3260f8cd

  • SHA1

    387b7e21c73d97a961b4068eb161966554e5d636

  • SHA256

    834a7e1fe6f21ed7d6957667e374c239a45c53dca406f1adbbe0fd219ac33cb1

  • SHA512

    dca9d7342a0ec71bf54951859962f2d4e48529043d538fa4dce8860d467f4b3b70a6f46d98e69d431e5d61ecda7ab218589ca60f13efe6d84535a699d1dbe9b8

  • SSDEEP

    384:bmM0V/YPvnr801TRoUGPh4TKt6ATt1DqgPa3s/zzo2E:b7o/2n1TCraU6GD1a4XC

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\80b019780e0d730bf212487a3260f8cd_cryptolocker_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\80b019780e0d730bf212487a3260f8cd_cryptolocker_JC.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1496
    • C:\Users\Admin\AppData\Local\Temp\rewok.exe
      "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
      2⤵
      • Executes dropped EXE
      PID:4844

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\rewok.exe

    Filesize

    30KB

    MD5

    2813ef2cea7f73bad8143dc6eb225f52

    SHA1

    4bd1eb8a8005256915122fdca6854f856660fec3

    SHA256

    af98a0dc3bbbb91bfa0996c9ea972aaf219a148dd91101c99d3aebe7a889b834

    SHA512

    6517118175ed734a349fed1f1d705d6120b345f3ef510a187c3380bb0f8be208054dae873adb8e390411235fecab91b06f2897ee75589e8989d7937addb26603

  • C:\Users\Admin\AppData\Local\Temp\rewok.exe

    Filesize

    30KB

    MD5

    2813ef2cea7f73bad8143dc6eb225f52

    SHA1

    4bd1eb8a8005256915122fdca6854f856660fec3

    SHA256

    af98a0dc3bbbb91bfa0996c9ea972aaf219a148dd91101c99d3aebe7a889b834

    SHA512

    6517118175ed734a349fed1f1d705d6120b345f3ef510a187c3380bb0f8be208054dae873adb8e390411235fecab91b06f2897ee75589e8989d7937addb26603

  • C:\Users\Admin\AppData\Local\Temp\rewok.exe

    Filesize

    30KB

    MD5

    2813ef2cea7f73bad8143dc6eb225f52

    SHA1

    4bd1eb8a8005256915122fdca6854f856660fec3

    SHA256

    af98a0dc3bbbb91bfa0996c9ea972aaf219a148dd91101c99d3aebe7a889b834

    SHA512

    6517118175ed734a349fed1f1d705d6120b345f3ef510a187c3380bb0f8be208054dae873adb8e390411235fecab91b06f2897ee75589e8989d7937addb26603

  • memory/1496-133-0x0000000002350000-0x0000000002356000-memory.dmp

    Filesize

    24KB

  • memory/1496-134-0x0000000002350000-0x0000000002356000-memory.dmp

    Filesize

    24KB

  • memory/1496-135-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/4844-153-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

    Filesize

    24KB