Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    158s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    14/02/2024, 18:23

General

  • Target

    2024-02-14_074973ab684dd7d268052ccd0cf5d5fd_cryptolocker.exe

  • Size

    34KB

  • MD5

    074973ab684dd7d268052ccd0cf5d5fd

  • SHA1

    f344c6ccc51274fc5511030f009bbff2b6e00007

  • SHA256

    9fba7ec6eb3de5b1488e2d5765c4a30cc785fb6d41ba1d8576f11c9cec7c5e52

  • SHA512

    817e49cd4ce1058604637b3f95046d33f80e01d01b1b32a72da040f03ee714ff2aabc0252cd09975f630a6a9652bf0da7fd16281ad49d3d6e7352d57349154d1

  • SSDEEP

    384:bA74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUgIunexRlSrxVfi:bA74zYcgT/Ekd0ryfjPIunYwdi

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-14_074973ab684dd7d268052ccd0cf5d5fd_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-14_074973ab684dd7d268052ccd0cf5d5fd_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2180
    • C:\Users\Admin\AppData\Local\Temp\hasfj.exe
      "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
      2⤵
      • Executes dropped EXE
      PID:2836

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\hasfj.exe

    Filesize

    34KB

    MD5

    69a03b16b10805f7b9cbc9f575b3a7b0

    SHA1

    8419a4386bfb221ab92c9171e80faff45082c96d

    SHA256

    fecfda5633571a1db92e2bf25a963b6c4383910a435ecf40d35f801db36f6cca

    SHA512

    eadb75231c7c50d5b268d07fa4bdee259c9487d3367ae93e34613a40db1766d9838a4ff4eae115ef2f68fe427608a612283f9c375c5950eae029f517077b4d0b

  • memory/2180-0-0x0000000000470000-0x0000000000476000-memory.dmp

    Filesize

    24KB

  • memory/2180-1-0x0000000000490000-0x0000000000496000-memory.dmp

    Filesize

    24KB

  • memory/2180-2-0x0000000000470000-0x0000000000476000-memory.dmp

    Filesize

    24KB

  • memory/2836-16-0x0000000000310000-0x0000000000316000-memory.dmp

    Filesize

    24KB

  • memory/2836-15-0x00000000002F0000-0x00000000002F6000-memory.dmp

    Filesize

    24KB