Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    23/01/2024, 00:30

General

  • Target

    2024-01-23_86096055f173830ee85352bc9caf4b96_cryptolocker.exe

  • Size

    72KB

  • MD5

    86096055f173830ee85352bc9caf4b96

  • SHA1

    647744389962512dd471d64c0dc49bf481af7ecb

  • SHA256

    e5c6ab36ad40c8d469c2e8a2b789742c0f628c132356bdbad37761f8131b5e25

  • SHA512

    e739d49a3881956dec7b54a77db891ebfca6d4ea01aa29f9849bd262cae4ae2c200bdea2e673dcf5724389ab4e233e898ad4c280c8a951bdbfbd2c94de50ccc2

  • SSDEEP

    1536:X6QFElP6n+gJQMOtEvwDpjBZYTjipvF2bx1Ma:X6a+SOtEvwDpjBZYvQd23

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-01-23_86096055f173830ee85352bc9caf4b96_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-23_86096055f173830ee85352bc9caf4b96_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1916
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:2904

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    72KB

    MD5

    76072aeba96d523ee4e6e4f598e5074f

    SHA1

    9d4f32adc2bfcf2d9418b85bb594b2e5b6b6058d

    SHA256

    1b2746b08deba9aa20f66d007477a65c725628a72fe830b25e535fe4abf8dda3

    SHA512

    89f8d92f0addc0ca8d33729a4d6c7988858ba54386bf8511f9fbbc958c64156482d3ddd72ec8e9979f98032cead2638c2b29d6be14eb6d66eaf1f52ce690c1ce

  • memory/1916-0-0x0000000000420000-0x0000000000426000-memory.dmp

    Filesize

    24KB

  • memory/1916-1-0x0000000000450000-0x0000000000456000-memory.dmp

    Filesize

    24KB

  • memory/1916-2-0x0000000000420000-0x0000000000426000-memory.dmp

    Filesize

    24KB

  • memory/2904-15-0x0000000000510000-0x0000000000516000-memory.dmp

    Filesize

    24KB

  • memory/2904-18-0x00000000004D0000-0x00000000004D6000-memory.dmp

    Filesize

    24KB