Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    13/02/2024, 05:27

General

  • Target

    2024-02-13_1667ee4cd77cd908f7889919514688a1_cryptolocker.exe

  • Size

    37KB

  • MD5

    1667ee4cd77cd908f7889919514688a1

  • SHA1

    0f65943b22b89fc00a9357e9c877860b3934925b

  • SHA256

    79a498a796d2f7a93434cd17ada2af8addb8e2f47f8616dd40bad2f71f5a7450

  • SHA512

    60ffe361be3433dc22de2d7ef121ea5d988e3c7bee00bfec6462560793db60d517d0c5bfc68961f40d829c01021f7de235f37ff24a713db3b98bb369a7a73329

  • SSDEEP

    768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6WaJIOc+UPPEkLUAp:YGzl5wjRQBBOsP1QMOtEvwDpjgarrkLt

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 3 IoCs
  • Detection of Cryptolocker Samples 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\asih.exe
    "C:\Users\Admin\AppData\Local\Temp\asih.exe"
    1⤵
    • Executes dropped EXE
    PID:2172
  • C:\Users\Admin\AppData\Local\Temp\2024-02-13_1667ee4cd77cd908f7889919514688a1_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-13_1667ee4cd77cd908f7889919514688a1_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2868

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    37KB

    MD5

    c8d0dfd7793318f2f832c4e68a0103cc

    SHA1

    c497873425eb295accb898708173d4b5d58bf9e1

    SHA256

    13021eae4655b191fb75148beecbc36f757623141e1094b5a300fdaab260e0f7

    SHA512

    23f762e96a1c9fe39a401cd69c72c239ca10380dc5f31edf94d5bec0a456aac5c8f40ccac96a5ce75a2a6044af503dbd01fc077a7bcc8bfc8677a431db7bf4a5

  • memory/2172-23-0x00000000002C0000-0x00000000002C6000-memory.dmp

    Filesize

    24KB

  • memory/2172-24-0x0000000000500000-0x000000000050B000-memory.dmp

    Filesize

    44KB

  • memory/2172-16-0x0000000000300000-0x0000000000306000-memory.dmp

    Filesize

    24KB

  • memory/2868-8-0x0000000000500000-0x000000000050B000-memory.dmp

    Filesize

    44KB

  • memory/2868-9-0x00000000001D0000-0x00000000001D6000-memory.dmp

    Filesize

    24KB

  • memory/2868-1-0x0000000000290000-0x0000000000296000-memory.dmp

    Filesize

    24KB

  • memory/2868-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

    Filesize

    24KB