Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    03/09/2023, 11:27

General

  • Target

    2023-08-22_a94c942d4a76c2c3ada89f1b7e8b3a8c_cryptolocker_JC.exe

  • Size

    59KB

  • MD5

    a94c942d4a76c2c3ada89f1b7e8b3a8c

  • SHA1

    c1a82efbbfa6f138ed74a1d5047665a151cfbc95

  • SHA256

    e47b8740904e9583137a0ad4fd922639d24ada1412df70dd1f7a45513be8744b

  • SHA512

    202c18b6f7f2ce84c6fe5a7f7e49a3d117ccd1150225ce10da1312a964472ab11c8df20fc681a1d12c6bf38c314795ff7ef2a59a0190d28c23447477f3ed8944

  • SSDEEP

    1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszudnYTjipvF29B:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7j

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2023-08-22_a94c942d4a76c2c3ada89f1b7e8b3a8c_cryptolocker_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\2023-08-22_a94c942d4a76c2c3ada89f1b7e8b3a8c_cryptolocker_JC.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2428
    • C:\Users\Admin\AppData\Local\Temp\hurok.exe
      "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2288

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\hurok.exe

    Filesize

    59KB

    MD5

    9cf6bfc61745ff822f8f3ba77fd4178e

    SHA1

    15e83ad6c3977ebdc71425d15042b0b6005f7294

    SHA256

    4d463618a7161d20327772c22b86d6e77fe95fe785bf5b945682ff33e887bffb

    SHA512

    427e5dd1c866785f85b7a32ec821f6495ce7e1c94095fd96ef6d9288e2f27f314338f3cf4348cb53cc16807617d19dc9b6fc2f5aa9bc3edbe91ea9c9f24802e2

  • C:\Users\Admin\AppData\Local\Temp\hurok.exe

    Filesize

    59KB

    MD5

    9cf6bfc61745ff822f8f3ba77fd4178e

    SHA1

    15e83ad6c3977ebdc71425d15042b0b6005f7294

    SHA256

    4d463618a7161d20327772c22b86d6e77fe95fe785bf5b945682ff33e887bffb

    SHA512

    427e5dd1c866785f85b7a32ec821f6495ce7e1c94095fd96ef6d9288e2f27f314338f3cf4348cb53cc16807617d19dc9b6fc2f5aa9bc3edbe91ea9c9f24802e2

  • \Users\Admin\AppData\Local\Temp\hurok.exe

    Filesize

    59KB

    MD5

    9cf6bfc61745ff822f8f3ba77fd4178e

    SHA1

    15e83ad6c3977ebdc71425d15042b0b6005f7294

    SHA256

    4d463618a7161d20327772c22b86d6e77fe95fe785bf5b945682ff33e887bffb

    SHA512

    427e5dd1c866785f85b7a32ec821f6495ce7e1c94095fd96ef6d9288e2f27f314338f3cf4348cb53cc16807617d19dc9b6fc2f5aa9bc3edbe91ea9c9f24802e2

  • memory/2288-16-0x00000000001C0000-0x00000000001C6000-memory.dmp

    Filesize

    24KB

  • memory/2428-0-0x0000000000230000-0x0000000000236000-memory.dmp

    Filesize

    24KB

  • memory/2428-1-0x0000000000230000-0x0000000000236000-memory.dmp

    Filesize

    24KB

  • memory/2428-2-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB