Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1s
  • max time network
    164s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    10/01/2024, 05:59

General

  • Target

    2024-01-09_a8ff2cede9752436e03ede89c806bddb_cryptolocker.exe

  • Size

    41KB

  • MD5

    a8ff2cede9752436e03ede89c806bddb

  • SHA1

    2e8d6eea07c1cef7ea8cc0c9c293b8c2d5bd92d5

  • SHA256

    ae185cf618f1e9b09faa82f716f646c469f356752ea40af58baa15ca10c6ead6

  • SHA512

    c9f34b31416fce5b46e508f9c53b4aeba0140b78b03aac5eb4f5ecc1a8b96db32c48fce550aa0e17c85173151e8507229a72e657d038358e5165b613554452db

  • SSDEEP

    384:e/4wODQkzonAYsju5N/surDQtOOtEvwDpjqIGROqS/WccJVJwi2B5oCCMB:79inqyNR/QtOOtEvwDpjBKccJVODvym

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\asih.exe
    "C:\Users\Admin\AppData\Local\Temp\asih.exe"
    1⤵
    • Executes dropped EXE
    PID:1020
  • C:\Users\Admin\AppData\Local\Temp\2024-01-09_a8ff2cede9752436e03ede89c806bddb_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-09_a8ff2cede9752436e03ede89c806bddb_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2236

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    14KB

    MD5

    ed7e9b200cf7c0fda977fc686ce0f5f4

    SHA1

    fbb2ca15d179c0af0f7a79559cf0fa8150ebfc31

    SHA256

    c617601ec538aa256ffec9bba5271f05e1e0845b2edcfd9c393d29960a2f9e16

    SHA512

    55a5a193ee5aa396dc88370edd71d1e85b824d8a984e69a87a0e09f82f27c00b2d75dd0058556724e2818c71f0ba670dceee14d2a16844c617180767476debbd

  • \Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    41KB

    MD5

    6a99ae9f353f9dc62f809ee6abb5d07e

    SHA1

    29b056ba48a1868fd8dda5938c0c97789c2f308f

    SHA256

    5de3cb5a2b171bb8c8c5d0b6351a183e65c769b51f46087e7e744b8f088a1001

    SHA512

    ba409a6a7d936f46d9c7bbc5b03a19568842bb36cfdcbb6c258e8c717b6bbb67afec7068dd432ccb7801d2f417635e6ce71db94a40ffff46958991c0ceb550d3

  • memory/1020-19-0x0000000000350000-0x0000000000356000-memory.dmp

    Filesize

    24KB

  • memory/1020-26-0x0000000000320000-0x0000000000326000-memory.dmp

    Filesize

    24KB

  • memory/1020-17-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/2236-1-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/2236-2-0x00000000003E0000-0x00000000003E6000-memory.dmp

    Filesize

    24KB

  • memory/2236-8-0x00000000001C0000-0x00000000001C6000-memory.dmp

    Filesize

    24KB

  • memory/2236-0-0x00000000001C0000-0x00000000001C6000-memory.dmp

    Filesize

    24KB

  • memory/2236-15-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/2236-14-0x0000000002700000-0x000000000270F000-memory.dmp

    Filesize

    60KB