Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
172s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
07/01/2024, 12:13
Behavioral task
behavioral1
Sample
2024-01-06_9a304cef97658f13556139beb5706d56_cryptolocker.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-06_9a304cef97658f13556139beb5706d56_cryptolocker.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-06_9a304cef97658f13556139beb5706d56_cryptolocker.exe
-
Size
61KB
-
MD5
9a304cef97658f13556139beb5706d56
-
SHA1
84453165b01531a40fb673a00a04ec193c804a53
-
SHA256
28c67d78a67eb0d400b501f4f41679bbcae73519eeb5c4d3d33d91c50cb34974
-
SHA512
c2deccb7bd513fb0502e8e0f825a3c6396f58ff8190160f29c40c0a7b2c6f1b2977aa30684c6ecd9322bec2815c51a835d235ff77311a621d4e9e66f28ecf048
-
SSDEEP
1536:P8mnK6QFElP6n+gymddpMOtEvwDpjY6UW:1nK6a+qdOOtEvwDpjX
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2740 asih.exe -
Loads dropped DLL 1 IoCs
pid Process 2116 2024-01-06_9a304cef97658f13556139beb5706d56_cryptolocker.exe -
resource yara_rule behavioral1/memory/2116-0-0x0000000000500000-0x000000000050F311-memory.dmp upx behavioral1/files/0x0009000000012266-11.dat upx behavioral1/memory/2116-12-0x0000000001E30000-0x0000000001E40000-memory.dmp upx behavioral1/memory/2116-15-0x0000000000500000-0x000000000050F311-memory.dmp upx behavioral1/memory/2740-17-0x0000000000500000-0x000000000050F311-memory.dmp upx behavioral1/memory/2740-27-0x0000000000500000-0x000000000050F311-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2116 wrote to memory of 2740 2116 2024-01-06_9a304cef97658f13556139beb5706d56_cryptolocker.exe 28 PID 2116 wrote to memory of 2740 2116 2024-01-06_9a304cef97658f13556139beb5706d56_cryptolocker.exe 28 PID 2116 wrote to memory of 2740 2116 2024-01-06_9a304cef97658f13556139beb5706d56_cryptolocker.exe 28 PID 2116 wrote to memory of 2740 2116 2024-01-06_9a304cef97658f13556139beb5706d56_cryptolocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-06_9a304cef97658f13556139beb5706d56_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-06_9a304cef97658f13556139beb5706d56_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
PID:2740
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5cc76c012ddaa2dd7c91b734ec122b88e
SHA1c4e88848ffde38fc3a27611543eafe99d514830f
SHA25644f299b6b7093c532a1beb98c82d09091c24a57f7d2f2f85807f90a1039c3459
SHA512cdffb774c01cd5ff17222045df646a496ec442755cf67c94c2d3809e0000bc125bec4a9bdfb66d90f1cd42eafad281dd3a890ba192f042e5fe941f4b107a3a0f