Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
13s -
max time network
184s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
05/01/2024, 05:47
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-01_9894d4e2ec69a06212db6c062e71a601_cryptolocker.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-01_9894d4e2ec69a06212db6c062e71a601_cryptolocker.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-01_9894d4e2ec69a06212db6c062e71a601_cryptolocker.exe
-
Size
39KB
-
MD5
9894d4e2ec69a06212db6c062e71a601
-
SHA1
bd2f15a9a3c505d1a2a3c9a31627a83dce224547
-
SHA256
d1c77c66e97f0a057a438b968edcbd73cb1cee46183d2fe7d70909c0e228fc75
-
SHA512
da9fc4559a07ddafdbdfd6cc52c163ed6c623bdf4842239a57b763f1e1cfcf37af1fbd6209ae980c6ef47d4cbc750883291c3a03ea323de28a7b6d9f08aab74a
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqh6nzhw:6j+1NMOtEvwDpjrRzi
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2276 misid.exe -
Loads dropped DLL 1 IoCs
pid Process 2340 2024-01-01_9894d4e2ec69a06212db6c062e71a601_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2340 wrote to memory of 2276 2340 2024-01-01_9894d4e2ec69a06212db6c062e71a601_cryptolocker.exe 17 PID 2340 wrote to memory of 2276 2340 2024-01-01_9894d4e2ec69a06212db6c062e71a601_cryptolocker.exe 17 PID 2340 wrote to memory of 2276 2340 2024-01-01_9894d4e2ec69a06212db6c062e71a601_cryptolocker.exe 17 PID 2340 wrote to memory of 2276 2340 2024-01-01_9894d4e2ec69a06212db6c062e71a601_cryptolocker.exe 17
Processes
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"1⤵
- Executes dropped EXE
PID:2276
-
C:\Users\Admin\AppData\Local\Temp\2024-01-01_9894d4e2ec69a06212db6c062e71a601_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-01_9894d4e2ec69a06212db6c062e71a601_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2340
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD5989494b66403c9b502d8603367083269
SHA1b68859427ddcfea47999db1350494be1e4253de7
SHA256faa53e6da98186c1c9067517b00a0c43d7b9fb2c9d08762d2f8f27a376d595c4
SHA512d7a0c39a9ca4ae35e127bc7f77e92e0fe5a42cd496753867ebdeb3b098f786996e05600e2d43487bb63cf4684a56749a7173be1151152e645e9d83e7dce39ac3
-
Filesize
24KB
MD507e7de456292bff899180569f6961e63
SHA1b3055d708ec53cf2cdf07e407298f16b394df9ca
SHA2560f940e6b604d9c987b7121b56ac1aa3b571c16acf0d847523fbfafa375730633
SHA512fe0248c0fd9a6234fedfa5cf190556c0aaa2fc6f3acb2d22667fb1ecb999c923e62bca516812455c470bd92d0e6617e93f156fe296961b68f61d849a03b70dc5
-
Filesize
1KB
MD5f36b41fe438e721be3491ddc7e3a3697
SHA13996f1c8c612dc0959bbcbab5d4346616d993958
SHA256698cfbdb818ece01e0ebce182008e24bdf14271427477e4f88deed166cb63a94
SHA5129300d32e21831aa7a7b7b81a32a0de30476839d7b2686671280995126eacfa7649b859041a42fdb6718e31a45ebf314f481b50042753a361ad38b54b165738c5