Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    28/01/2024, 05:31

General

  • Target

    2024-01-28_8bec0bc0757b3485a750ba0ddf1ab05d_cryptolocker.exe

  • Size

    96KB

  • MD5

    8bec0bc0757b3485a750ba0ddf1ab05d

  • SHA1

    65ac928588443eda471aca2b4836f93ec55886c2

  • SHA256

    7692ecfaf313d027afdea452c50a9827689d058c79d77cf3c858191e1159a82a

  • SHA512

    e2ae5311322733e7c0ce9540879731b743e6d8283ad2b22cf8d082c42dcd685deef1eb7c917b24c0727ba4ff2bd7f6aefa4180ae4c47b0893de29a72e50ad127

  • SSDEEP

    1536:26QFElP6n+gBQMOtEvwDpjQGYQbN/PKwNCWPx:26a+2OtEvwDpjtzn

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-01-28_8bec0bc0757b3485a750ba0ddf1ab05d_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-28_8bec0bc0757b3485a750ba0ddf1ab05d_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1696
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:2176

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    97KB

    MD5

    81770f5840e0cc9e2b32a2cf33c1e289

    SHA1

    7826fa319adc5d346ae82900554cdbca0efc0f8e

    SHA256

    38429e8a9302b00b7ce38045a6f7ddbad4c130a78c72256b7b83c2d5e7aa9a49

    SHA512

    b2335fdaaeb9dce46dc994de193de95752a6e1c6d8448176e9b143c937c0b2626baa768459d7aa96c935c9f3bbedb40e3ac7cbc513265d2da583ebb9490a1939

  • memory/1696-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

    Filesize

    24KB

  • memory/1696-1-0x0000000000300000-0x0000000000306000-memory.dmp

    Filesize

    24KB

  • memory/1696-7-0x00000000002C0000-0x00000000002C6000-memory.dmp

    Filesize

    24KB

  • memory/2176-16-0x0000000000480000-0x0000000000486000-memory.dmp

    Filesize

    24KB

  • memory/2176-15-0x0000000000450000-0x0000000000456000-memory.dmp

    Filesize

    24KB