Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
23/10/2023, 20:52
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.2023-09-06_4b49507bbdf9775141d4e6209e60d13a_cryptolocker_JC.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.2023-09-06_4b49507bbdf9775141d4e6209e60d13a_cryptolocker_JC.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.2023-09-06_4b49507bbdf9775141d4e6209e60d13a_cryptolocker_JC.exe
-
Size
41KB
-
MD5
4b49507bbdf9775141d4e6209e60d13a
-
SHA1
812c52846b4b414b2456949a2c93aefc11ce1241
-
SHA256
3e2397413325f6129609fd218cd032909e5e2caa79533fc62e9805abc660a3b7
-
SHA512
d8e3cb6f7d9c04569bf7b9463285435fd1b663059b788aef3877bc8d2f7aad5e2780737efc06d3153b0b86e97720f611bc5dda16751fcb5ff80c3f836ea529b8
-
SSDEEP
768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6j4AYsqSh+DETkedm+k:YGzl5wjRQBBOsP1QMOtEvwDpjl39+D+w
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2432 asih.exe -
Loads dropped DLL 1 IoCs
pid Process 2336 NEAS.2023-09-06_4b49507bbdf9775141d4e6209e60d13a_cryptolocker_JC.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2336 wrote to memory of 2432 2336 NEAS.2023-09-06_4b49507bbdf9775141d4e6209e60d13a_cryptolocker_JC.exe 28 PID 2336 wrote to memory of 2432 2336 NEAS.2023-09-06_4b49507bbdf9775141d4e6209e60d13a_cryptolocker_JC.exe 28 PID 2336 wrote to memory of 2432 2336 NEAS.2023-09-06_4b49507bbdf9775141d4e6209e60d13a_cryptolocker_JC.exe 28 PID 2336 wrote to memory of 2432 2336 NEAS.2023-09-06_4b49507bbdf9775141d4e6209e60d13a_cryptolocker_JC.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-06_4b49507bbdf9775141d4e6209e60d13a_cryptolocker_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-06_4b49507bbdf9775141d4e6209e60d13a_cryptolocker_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
PID:2432
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD58742859b7f256bfd3abfb67a54a6a450
SHA124f3254f3b28638eb1ca436ba5e5a4ebf4bb2dbd
SHA256203d4bde0e5907a7d8036853680ae2f7115821fd5e01ad1bc7acee8a980c9864
SHA5122b5f1febcba7fdc4deee9eb0e406ef6142eac8ceb709fb0fd31ae2c0613fbbaa7ba55aca23083aade9361e0155f20df66ba01f4b7b40e8d44f5ae3c8be1de1c0
-
Filesize
41KB
MD58742859b7f256bfd3abfb67a54a6a450
SHA124f3254f3b28638eb1ca436ba5e5a4ebf4bb2dbd
SHA256203d4bde0e5907a7d8036853680ae2f7115821fd5e01ad1bc7acee8a980c9864
SHA5122b5f1febcba7fdc4deee9eb0e406ef6142eac8ceb709fb0fd31ae2c0613fbbaa7ba55aca23083aade9361e0155f20df66ba01f4b7b40e8d44f5ae3c8be1de1c0
-
Filesize
41KB
MD58742859b7f256bfd3abfb67a54a6a450
SHA124f3254f3b28638eb1ca436ba5e5a4ebf4bb2dbd
SHA256203d4bde0e5907a7d8036853680ae2f7115821fd5e01ad1bc7acee8a980c9864
SHA5122b5f1febcba7fdc4deee9eb0e406ef6142eac8ceb709fb0fd31ae2c0613fbbaa7ba55aca23083aade9361e0155f20df66ba01f4b7b40e8d44f5ae3c8be1de1c0