Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    11/02/2024, 11:50

General

  • Target

    2024-02-11_f9e31738289363b5571918e60dbf3c0d_cryptolocker.exe

  • Size

    48KB

  • MD5

    f9e31738289363b5571918e60dbf3c0d

  • SHA1

    1270a27dc4880874ae9b10922f344e80f8ccedd0

  • SHA256

    65580d8206e38ecf6288067d5d00e743a5cf6acd64e0a841cec84430e4c3711c

  • SHA512

    32a5b5eeb96d29527a7849bbdc7a1eea32eec5dcfdbb381b0083e160c3e67d6894434e7de725eeeaf99cc61792c246bc4dfca5938e89144fb33fd89444700991

  • SSDEEP

    384:icX+ni9VCr5nQI021q4VQBqURYp055TOtOOtEvwDpjqIGR/hHi7/OlI0G/74zpzv:XS5nQJ24LR1bytOOtEvwDpjNbP/0Geht

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • Detection of Cryptolocker Samples 4 IoCs
  • Detects executables built or packed with MPress PE compressor 5 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-11_f9e31738289363b5571918e60dbf3c0d_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-11_f9e31738289363b5571918e60dbf3c0d_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2848
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Executes dropped EXE
      PID:2556

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    48KB

    MD5

    cd1fb6ec8c11f9208201ea412e709224

    SHA1

    edd806ee49972eeea1e34f3b9d461ba767cc813a

    SHA256

    82492dc7fa0c3fe0fd4804ebd9d228d8afcd98eaa461f0cbd770566e815867fe

    SHA512

    3229591a53ec4918ca827a4ef7e66820ace4869cf6cb206743ec349c6a4ef537b68e884b581c192e4ae6a97544cba1c73d46b1ff13c909977a1813b59d26853d

  • memory/2556-18-0x00000000004E0000-0x00000000004E6000-memory.dmp

    Filesize

    24KB

  • memory/2556-17-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/2556-20-0x00000000004A0000-0x00000000004A6000-memory.dmp

    Filesize

    24KB

  • memory/2556-26-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/2848-0-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/2848-1-0x00000000001D0000-0x00000000001D6000-memory.dmp

    Filesize

    24KB

  • memory/2848-2-0x00000000001D0000-0x00000000001D6000-memory.dmp

    Filesize

    24KB

  • memory/2848-3-0x00000000004D0000-0x00000000004D6000-memory.dmp

    Filesize

    24KB

  • memory/2848-15-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB