Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    12/02/2024, 14:00

General

  • Target

    2024-02-12_e57be985168e259b821b9b6e729da62b_cryptolocker.exe

  • Size

    41KB

  • MD5

    e57be985168e259b821b9b6e729da62b

  • SHA1

    193d47c27c0c0a8d9d5fb6f0f52d1a8755056444

  • SHA256

    c5fe884397fd9ad620bde976b57946ab6483516de309b62712f43514bbdb65d6

  • SHA512

    6ee0a78e9282299d9c5dc4afde36da35986b8ef08908545cc71b8454fae0317710073722ec461988f2e2478788bd2523b976b1d6e8de53ce7e3989cdb2aa56c6

  • SSDEEP

    768:bgX4zYcgTEu6QOaryfjqDDw3sCu5b+syk:bgGYcA/53GADw8Cl/k

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-12_e57be985168e259b821b9b6e729da62b_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-12_e57be985168e259b821b9b6e729da62b_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2616
    • C:\Users\Admin\AppData\Local\Temp\hasfj.exe
      "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
      2⤵
      • Executes dropped EXE
      PID:2172

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\hasfj.exe

    Filesize

    42KB

    MD5

    fde9592e555f77218fd9475031833bdb

    SHA1

    801177c1ce4f6b365ee520dec5c3192c0fd42160

    SHA256

    96b01d41e0da313e56a8768b12dd3c920a72f602e06e916f59efea74e845170c

    SHA512

    105ee8b4d4b63b61d420363cf323a24a362b5d7d7a2b642136eb0669a2458fa2c12f28ba18eadc1a29d381ae174b24916f466a3e7148ea2074eeb76db01c63ca

  • memory/2172-15-0x0000000001BC0000-0x0000000001BC6000-memory.dmp

    Filesize

    24KB

  • memory/2172-19-0x0000000001BA0000-0x0000000001BA6000-memory.dmp

    Filesize

    24KB

  • memory/2616-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

    Filesize

    24KB

  • memory/2616-2-0x00000000004D0000-0x00000000004D6000-memory.dmp

    Filesize

    24KB

  • memory/2616-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

    Filesize

    24KB