Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    26/01/2024, 23:24

General

  • Target

    2024-01-26_a3bc3ee592c417d1682798eef73bdf7f_cryptolocker.exe

  • Size

    60KB

  • MD5

    a3bc3ee592c417d1682798eef73bdf7f

  • SHA1

    3e9abd20e3601d07c11498ceb09e69366a290a16

  • SHA256

    bda6fbe3acdbc084a55f8dc2055ab44c0355c5e9fbec760ec526f10137a605ff

  • SHA512

    a5b09b2ba15180f6571f063be130d89791f0e5924fcafa6fd04beeea46fa6b982adbe6cdf688a431c38f1ecc11db788345f1d922ba937e9fb570a0f58c808b64

  • SSDEEP

    1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMw:TCjsIOtEvwDpj5HE/OUHnSMP

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • Detection of Cryptolocker Samples 5 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-01-26_a3bc3ee592c417d1682798eef73bdf7f_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-26_a3bc3ee592c417d1682798eef73bdf7f_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:3024
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Executes dropped EXE
      PID:2116

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    61KB

    MD5

    d7f9ed9c557ad888a29d1e91b7d9fb10

    SHA1

    762b432108db556ee503e36c97478fe786d97d4e

    SHA256

    d5279dba53537a5983b0a1ded0eacb22e961ab998ab6c37fa27e06ab2af5abbc

    SHA512

    f384d192ad45af7597ea9438a83e6f204a5220afa43baf33dc153adf08ed97f5e33539ac4566ed72a9ecc2f8eea35268246a037b004a73b205ee015c1a7f5bbd

  • memory/2116-18-0x0000000000470000-0x0000000000476000-memory.dmp

    Filesize

    24KB

  • memory/2116-20-0x0000000000320000-0x0000000000326000-memory.dmp

    Filesize

    24KB

  • memory/2116-17-0x0000000000500000-0x000000000050E000-memory.dmp

    Filesize

    56KB

  • memory/2116-26-0x0000000000500000-0x000000000050E000-memory.dmp

    Filesize

    56KB

  • memory/3024-0-0x0000000000500000-0x000000000050E000-memory.dmp

    Filesize

    56KB

  • memory/3024-1-0x00000000002D0000-0x00000000002D6000-memory.dmp

    Filesize

    24KB

  • memory/3024-2-0x0000000000310000-0x0000000000316000-memory.dmp

    Filesize

    24KB

  • memory/3024-9-0x00000000002D0000-0x00000000002D6000-memory.dmp

    Filesize

    24KB

  • memory/3024-15-0x0000000000500000-0x000000000050E000-memory.dmp

    Filesize

    56KB