Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    09/01/2024, 06:42

General

  • Target

    2024-01-08_7688ca8f750159fd834b8c5dc423205d_cryptolocker.exe

  • Size

    73KB

  • MD5

    7688ca8f750159fd834b8c5dc423205d

  • SHA1

    1a3ec3460296e1ade68db3b8eabe01a1b9db6b28

  • SHA256

    28cd81043f7ad4fbed9311521f3bc76c57c44e75e2dbc05b7b0f109363babb03

  • SHA512

    07321a8de2062db9a6b415ba384ef735744d39561a3cf9732bf70a13e7f0ab7eba7e72f8942349f7ca15f72ef205d233bb54860f58070d8987a44991c5584e79

  • SSDEEP

    1536:ZzFbxmLPWQMOtEvwDpj386Sj/WprgJN6tZdOyJ3K0:ZVxkGOtEvwDpjcaz

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-01-08_7688ca8f750159fd834b8c5dc423205d_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-08_7688ca8f750159fd834b8c5dc423205d_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2972
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Executes dropped EXE
      PID:2880

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    73KB

    MD5

    d62c1ca03d440fc906bdb3289371a5f9

    SHA1

    a45b591d6473d591eaeaf77d9bea496b5c64b6d6

    SHA256

    caa866b01733597bbced284bc150cb90add9fb8456bc2eb291dadb7430911859

    SHA512

    b0ae297c7f2322f2ae561b54e9a6a9a466b14a443c427590097f718a5236f443c59e70cb9abdf7bfce701d45b0768895558927f66f1b151ce9e89c8bbfe22868

  • memory/2880-15-0x00000000001D0000-0x00000000001D6000-memory.dmp

    Filesize

    24KB

  • memory/2880-17-0x0000000000280000-0x0000000000286000-memory.dmp

    Filesize

    24KB

  • memory/2972-0-0x00000000001C0000-0x00000000001C3000-memory.dmp

    Filesize

    12KB

  • memory/2972-1-0x00000000001D0000-0x00000000001D6000-memory.dmp

    Filesize

    24KB

  • memory/2972-2-0x00000000001D0000-0x00000000001D6000-memory.dmp

    Filesize

    24KB

  • memory/2972-3-0x0000000000200000-0x0000000000206000-memory.dmp

    Filesize

    24KB