Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    29/01/2024, 05:22

General

  • Target

    2024-01-29_02572f30f39d569f7343ab94549618af_cryptolocker.exe

  • Size

    40KB

  • MD5

    02572f30f39d569f7343ab94549618af

  • SHA1

    d439d1a265a6b571b645f3e45da98df6b463b086

  • SHA256

    c7a9c00935c18aba0e12e511cc242667e757f96cc32c1bca2fe7ae1a0df3ab24

  • SHA512

    acddb38d3f7b7e24fa17c77e7a3da5643556ee42c27e70c172c21e14d0da8f56a38b829715284bc19ec405c9a1f1b55e3a8a82117602a8f65aecdc4e6729c683

  • SSDEEP

    768:bIDOw9UiaCHfjnE0Sf88AvvP1oghYvm9/6Dy8PE4:bIDOw9a0Dwo3P1ojvUSDhc4

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-01-29_02572f30f39d569f7343ab94549618af_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-29_02572f30f39d569f7343ab94549618af_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1320
    • C:\Users\Admin\AppData\Local\Temp\lossy.exe
      "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
      2⤵
      • Executes dropped EXE
      PID:2376

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\lossy.exe

    Filesize

    40KB

    MD5

    3b43ae917699374211956ddc525aeb48

    SHA1

    f0790df88aa5948d1771c6cdefaa9506c6d7888f

    SHA256

    bc1fa74d8bf4701931bd7ac3654d4264a90ccc023009a9455bec19c0c3079cdb

    SHA512

    a078a6d5e818c42905d5a8c2ccff3552b40e5ac7ed9900eebeac4a9fdbb1e2737a339be147485937aee925b65f43193404f555c4b94e953d201480f4f21aab98

  • memory/1320-0-0x0000000000320000-0x0000000000326000-memory.dmp

    Filesize

    24KB

  • memory/1320-2-0x0000000000450000-0x0000000000456000-memory.dmp

    Filesize

    24KB

  • memory/1320-1-0x0000000000320000-0x0000000000326000-memory.dmp

    Filesize

    24KB

  • memory/2376-15-0x0000000001C80000-0x0000000001C86000-memory.dmp

    Filesize

    24KB

  • memory/2376-22-0x0000000000440000-0x0000000000446000-memory.dmp

    Filesize

    24KB