Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    132s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    12/02/2024, 20:33

General

  • Target

    2024-02-12_df55cf0e5aa893e08b81a61df5ac114c_cryptolocker.exe

  • Size

    54KB

  • MD5

    df55cf0e5aa893e08b81a61df5ac114c

  • SHA1

    b97112ea098a6a904793f6451f891ed5c40dd755

  • SHA256

    54a144181f0bd513364b8999db018836ad3051cfcd1d22a1a625c0baa6fdbb4e

  • SHA512

    42fee0936b3df09035b97605328bf044a537f983f1066bc18a72b3819018462e145c678a94cd0b034e1ebf253134aa50804f82fa3180189feb7cb3b7940a3bd4

  • SSDEEP

    768:X6LsoEEeegiZPvEhHSG+gp/BtOOtEvwDpjBVaD3E09vaTiSfQaV2L0zNnm:X6QFElP6n+gJBMOtEvwDpjBtE1yILum

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-12_df55cf0e5aa893e08b81a61df5ac114c_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-12_df55cf0e5aa893e08b81a61df5ac114c_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2120
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:2760

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    54KB

    MD5

    9ae4ecab7cce36360baefcf119bbfcf5

    SHA1

    a6ba43302a965cc3cdb8c5a0d7ef9c83f4dcc6ed

    SHA256

    d950f5942460fda1187401ba1941d95d00b54a928beb836a0e43dc26fe0a286c

    SHA512

    69d811b4190c7cd97d3e4b5678cfbf772853bb07cfbd55cb83d72d48d545f6cf0daab35e5e5359a54ca7a6b20ec3d26d8c1c94dcbdeb2fdae06f320ae4d3ed77

  • memory/2120-0-0x0000000000300000-0x0000000000306000-memory.dmp

    Filesize

    24KB

  • memory/2120-1-0x0000000000340000-0x0000000000346000-memory.dmp

    Filesize

    24KB

  • memory/2120-7-0x0000000000300000-0x0000000000306000-memory.dmp

    Filesize

    24KB

  • memory/2760-15-0x0000000000270000-0x0000000000276000-memory.dmp

    Filesize

    24KB

  • memory/2760-17-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB