Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    13s
  • max time network
    184s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    05/01/2024, 05:47

General

  • Target

    2024-01-01_9894d4e2ec69a06212db6c062e71a601_cryptolocker.exe

  • Size

    39KB

  • MD5

    9894d4e2ec69a06212db6c062e71a601

  • SHA1

    bd2f15a9a3c505d1a2a3c9a31627a83dce224547

  • SHA256

    d1c77c66e97f0a057a438b968edcbd73cb1cee46183d2fe7d70909c0e228fc75

  • SHA512

    da9fc4559a07ddafdbdfd6cc52c163ed6c623bdf4842239a57b763f1e1cfcf37af1fbd6209ae980c6ef47d4cbc750883291c3a03ea323de28a7b6d9f08aab74a

  • SSDEEP

    768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqh6nzhw:6j+1NMOtEvwDpjrRzi

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\misid.exe
    "C:\Users\Admin\AppData\Local\Temp\misid.exe"
    1⤵
    • Executes dropped EXE
    PID:2276
  • C:\Users\Admin\AppData\Local\Temp\2024-01-01_9894d4e2ec69a06212db6c062e71a601_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-01_9894d4e2ec69a06212db6c062e71a601_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2340

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    38KB

    MD5

    989494b66403c9b502d8603367083269

    SHA1

    b68859427ddcfea47999db1350494be1e4253de7

    SHA256

    faa53e6da98186c1c9067517b00a0c43d7b9fb2c9d08762d2f8f27a376d595c4

    SHA512

    d7a0c39a9ca4ae35e127bc7f77e92e0fe5a42cd496753867ebdeb3b098f786996e05600e2d43487bb63cf4684a56749a7173be1151152e645e9d83e7dce39ac3

  • C:\Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    24KB

    MD5

    07e7de456292bff899180569f6961e63

    SHA1

    b3055d708ec53cf2cdf07e407298f16b394df9ca

    SHA256

    0f940e6b604d9c987b7121b56ac1aa3b571c16acf0d847523fbfafa375730633

    SHA512

    fe0248c0fd9a6234fedfa5cf190556c0aaa2fc6f3acb2d22667fb1ecb999c923e62bca516812455c470bd92d0e6617e93f156fe296961b68f61d849a03b70dc5

  • \Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    1KB

    MD5

    f36b41fe438e721be3491ddc7e3a3697

    SHA1

    3996f1c8c612dc0959bbcbab5d4346616d993958

    SHA256

    698cfbdb818ece01e0ebce182008e24bdf14271427477e4f88deed166cb63a94

    SHA512

    9300d32e21831aa7a7b7b81a32a0de30476839d7b2686671280995126eacfa7649b859041a42fdb6718e31a45ebf314f481b50042753a361ad38b54b165738c5

  • memory/2276-26-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2276-19-0x0000000000270000-0x0000000000276000-memory.dmp

    Filesize

    24KB

  • memory/2276-17-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/2276-27-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/2340-0-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/2340-13-0x0000000002700000-0x000000000270F000-memory.dmp

    Filesize

    60KB

  • memory/2340-9-0x00000000004E0000-0x00000000004E6000-memory.dmp

    Filesize

    24KB

  • memory/2340-2-0x0000000000520000-0x0000000000526000-memory.dmp

    Filesize

    24KB

  • memory/2340-15-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/2340-1-0x00000000004E0000-0x00000000004E6000-memory.dmp

    Filesize

    24KB