Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

2023-08-26...JC.exe

windows7-x64

7

2023-08-26...JC.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    141s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/09/2023, 10:48 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2023-08-26_0f4b16be0052e0bab6698d9c9331844f_cryptolocker_JC.exe

  • Size

    44KB

  • MD5

    0f4b16be0052e0bab6698d9c9331844f

  • SHA1

    6ca9b24bef24dfee7266666e279c9e42b1c212f8

  • SHA256

    06b3b71920ef29235367f53be7040c9d8455e3d36e40916821709029eabc4619

  • SHA512

    e357e2a078cbf53e4a811dfaa71c8d81146d2fd736cb956e50406ebb0b08628b4822391e4ac3eb68ae127bebdad99ff2802329792fb5530b7bfb737a8a4c54ca

  • SSDEEP

    768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpjeJQ7suIlsw92KFXckd9d:V6QFElP6n+gMQMOtEvwDpjeJQ7pojakd

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2023-08-26_0f4b16be0052e0bab6698d9c9331844f_cryptolocker_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\2023-08-26_0f4b16be0052e0bab6698d9c9331844f_cryptolocker_JC.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1824
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:2800

Network

  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    4.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    4.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    1.202.248.87.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    1.202.248.87.in-addr.arpa
    IN PTR
    Response
    1.202.248.87.in-addr.arpa
    IN PTR
    https-87-248-202-1amsllnwnet
  • flag-us
    DNS
    241.154.82.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.154.82.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    41.110.16.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    41.110.16.96.in-addr.arpa
    IN PTR
    Response
    41.110.16.96.in-addr.arpa
    IN PTR
    a96-16-110-41deploystaticakamaitechnologiescom
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    88.156.103.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.156.103.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    emrlogistics.com
    asih.exe
    Remote address:
    8.8.8.8:53
    Request
    emrlogistics.com
    IN A
    Response
    emrlogistics.com
    IN CNAME
    traff-4.hugedomains.com
    traff-4.hugedomains.com
    IN CNAME
    hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com
    hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com
    IN A
    3.94.41.167
    hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com
    IN A
    52.86.6.113
  • flag-us
    DNS
    86.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    86.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    8.3.197.209.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.3.197.209.in-addr.arpa
    IN PTR
    Response
    8.3.197.209.in-addr.arpa
    IN PTR
    vip0x008map2sslhwcdnnet
  • flag-us
    DNS
    240.81.21.72.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    240.81.21.72.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    48.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    48.229.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    90.16.208.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    90.16.208.104.in-addr.arpa
    IN PTR
    Response
  • 3.94.41.167:443
    emrlogistics.com
    asih.exe
    260 B
     5
  • 52.86.6.113:443
    emrlogistics.com
    asih.exe
    260 B
     5
  • 3.94.41.167:443
    emrlogistics.com
    asih.exe
    260 B
     5
  • 52.86.6.113:443
    emrlogistics.com
    asih.exe
    260 B
     5
  • 3.94.41.167:443
    emrlogistics.com
    asih.exe
    260 B
     5
  • 52.86.6.113:443
    emrlogistics.com
    asih.exe
    260 B
     5
  • 3.94.41.167:443
    emrlogistics.com
    asih.exe
    260 B
     5
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
     90 B
     1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    4.159.190.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    4.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    1.202.248.87.in-addr.arpa
    dns
    71 B
     116 B
     1
    1

    DNS Request

    1.202.248.87.in-addr.arpa

  • 8.8.8.8:53
    241.154.82.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    241.154.82.20.in-addr.arpa

  • 8.8.8.8:53
    41.110.16.96.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    41.110.16.96.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    88.156.103.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    88.156.103.20.in-addr.arpa

  • 8.8.8.8:53
    emrlogistics.com
    dns
    asih.exe
    62 B
     192 B
     1
    1

    DNS Request

    emrlogistics.com

    DNS Response

    3.94.41.167
    52.86.6.113

  • 8.8.8.8:53
    86.23.85.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    86.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    206.23.85.13.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    206.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    8.3.197.209.in-addr.arpa
    dns
    70 B
     111 B
     1
    1

    DNS Request

    8.3.197.209.in-addr.arpa

  • 8.8.8.8:53
    240.81.21.72.in-addr.arpa
    dns
    71 B
     142 B
     1
    1

    DNS Request

    240.81.21.72.in-addr.arpa

  • 8.8.8.8:53
    48.229.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    48.229.111.52.in-addr.arpa

  • 8.8.8.8:53
    90.16.208.104.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    90.16.208.104.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe
    Filesize

    44KB

    MD5

    f0802b59367aea3b5582e36c7ccffcfb

    SHA1

    13502a5f93b041aa22a5ab1803025c4a969cc381

    SHA256

    f939cd3ec83c584bd02d35b57ee4aada3e2cd0727d2cdebcd7b05ba28e67fcde

    SHA512

    e6ecb9d31dc15ddb5378cd0983df735cda87a4005119993b72e98afa86ca897d161a688de59eea2b4f97865a912bd7423a0247ec63430c8f215bb12dbdd3b9e3

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\asih.exe
    Filesize

    44KB

    MD5

    f0802b59367aea3b5582e36c7ccffcfb

    SHA1

    13502a5f93b041aa22a5ab1803025c4a969cc381

    SHA256

    f939cd3ec83c584bd02d35b57ee4aada3e2cd0727d2cdebcd7b05ba28e67fcde

    SHA512

    e6ecb9d31dc15ddb5378cd0983df735cda87a4005119993b72e98afa86ca897d161a688de59eea2b4f97865a912bd7423a0247ec63430c8f215bb12dbdd3b9e3

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\asih.exe
    Filesize

    44KB

    MD5

    f0802b59367aea3b5582e36c7ccffcfb

    SHA1

    13502a5f93b041aa22a5ab1803025c4a969cc381

    SHA256

    f939cd3ec83c584bd02d35b57ee4aada3e2cd0727d2cdebcd7b05ba28e67fcde

    SHA512

    e6ecb9d31dc15ddb5378cd0983df735cda87a4005119993b72e98afa86ca897d161a688de59eea2b4f97865a912bd7423a0247ec63430c8f215bb12dbdd3b9e3

    Download Submit

  • memory/1824-0-0x00000000004D0000-0x00000000004D6000-memory.dmp

    Filesize

    24KB

    Download

  • memory/1824-1-0x00000000004D0000-0x00000000004D6000-memory.dmp

    Filesize

    24KB

    Download

  • memory/1824-2-0x00000000004F0000-0x00000000004F6000-memory.dmp

    Filesize

    24KB

    Download

  • memory/2800-17-0x00000000006C0000-0x00000000006C6000-memory.dmp

    Filesize

    24KB

    Download

  • memory/2800-18-0x00000000006E0000-0x00000000006E6000-memory.dmp

    Filesize

    24KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.