Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    24/01/2024, 13:30

General

  • Target

    2024-01-24_c296c29fb7c63f1b9c13ade1aa6087fe_cryptolocker.exe

  • Size

    32KB

  • MD5

    c296c29fb7c63f1b9c13ade1aa6087fe

  • SHA1

    ce6132dd4b5bcf91a1f36d046e50732e9e4eb741

  • SHA256

    4ff44ccfddc7c9d2fb8cfc52becd3cf1377f859ebb9fd868dcafffdfd2e0dc1e

  • SHA512

    c35cc4e72e1a63fbeb7a45635cfad3a912d41e5ddbd018ff28126181bc35b00931dd204d6193c9679d20d5ad9eb43ecbad2de0e3bf62a83a03387a40bb858f2f

  • SSDEEP

    384:bAvMaNGh4z7CG3POOvbRSLoF/F0QU5XYFnufc/zzo6ckJp0qAMub5X:bAvJCYOOvbRPDEgXRc+BA/b5

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-01-24_c296c29fb7c63f1b9c13ade1aa6087fe_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-24_c296c29fb7c63f1b9c13ade1aa6087fe_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1960
    • C:\Users\Admin\AppData\Local\Temp\demka.exe
      "C:\Users\Admin\AppData\Local\Temp\demka.exe"
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:2976

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    0a86cee1a12b4d0eff5b9b86e04f34d0

    SHA1

    dc58aa00b941ce83125adfc066babd6b44c0d60e

    SHA256

    920ffccbb812301f09c1ce3e3df15998beb92f3fca35e80648312a98ca36c1d0

    SHA512

    21ac3644bf5d80f947782bc36886227e0329c4ec56387b68dabd4ae8cebbc02ceab58dc0ea7aec7554f9af5af76d13ebfb879b2f36eda871444781e618edb40a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    b3d27e07791e323608d74695c01dfcf6

    SHA1

    d8f9b8b616252842137ae898fb8c8b73b678e948

    SHA256

    23c22990eaf7c1c341d43a32a9f9f0c797a5796848ecace9358e689560060922

    SHA512

    cb950cd451cabdc0482b6b89d058df1cdbd0471b61e20a37a88c491dd5dca5daa70bc40131a541ed2c0d33fe79262772040f7f2298d013f9a75005e47ce768cb

  • C:\Users\Admin\AppData\Local\Temp\Tar801.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • \Users\Admin\AppData\Local\Temp\demka.exe

    Filesize

    32KB

    MD5

    b3f64ccfeebb9f275e5929e84f3fa580

    SHA1

    110f787426ea1b78124bd1c69eebd54972a8ed1e

    SHA256

    1a1d7c661faf0fd0716c2bc4b90129a24cb4ad9019a366146152b34a66bbfe6f

    SHA512

    2c936e30de42b091a96d84ed0db27486d9f5ee216d0c2576e86348424af2ce8ef01a4a195d5252d5f9fe30361b92bbc6d718d52dcbcce1ed903607062eb40423

  • memory/1960-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

    Filesize

    24KB

  • memory/1960-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

    Filesize

    24KB

  • memory/1960-2-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/2976-16-0x00000000003D0000-0x00000000003D6000-memory.dmp

    Filesize

    24KB