Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    17/02/2024, 07:51

General

  • Target

    2024-02-17_c483ff063146e1efe12403550600ee69_cryptolocker.exe

  • Size

    61KB

  • MD5

    c483ff063146e1efe12403550600ee69

  • SHA1

    cfe8ef09717ee1b99d37d2444730abbff7cac07f

  • SHA256

    5a71ec0fca52d36a0fa5e7aedae9b26af9bb1741b896af3dc24890197ab5730a

  • SHA512

    c5bf257d59d6819bd2ff53cabee3ea16f0f8745aea0ced57438e20cebd695b0abdb2336d8cfcf1f0cf28d42d65a20ecebf2b03877c36b46fc1d67994dfdbf1c7

  • SSDEEP

    768:zQz7yVEhs9+syJP6ntOOtEvwDpjFelaB7yBEY9Su8F5mnVs:zj+soPSMOtEvwDpj4kpmeLmnS

Score
9/10
upx

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • Detection of Cryptolocker Samples 5 IoCs
  • UPX dump on OEP (original entry point) 5 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-17_c483ff063146e1efe12403550600ee69_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-17_c483ff063146e1efe12403550600ee69_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2856
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Executes dropped EXE
      PID:3040

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    62KB

    MD5

    e9027ccb8a115f10f2e0303242e27ce0

    SHA1

    c828100fcd092c776a8d59487401f8a4ede98677

    SHA256

    b7c0d74435f8a64262ab1da4dfee00c90b1d4763f6e2c8ee83766033c17a46d0

    SHA512

    3ca92ab8ee207c00a55bdc853de85ac4dadbab8232906aa7a22207795d060e8b701e93cb66e2476f1cbae9523d22c1fe6c72a82011ccac899cc7849665be9964

  • memory/2856-0-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2856-1-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2856-2-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2856-3-0x0000000000480000-0x0000000000486000-memory.dmp

    Filesize

    24KB

  • memory/2856-15-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/3040-16-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/3040-19-0x00000000002A0000-0x00000000002A6000-memory.dmp

    Filesize

    24KB

  • memory/3040-18-0x00000000001E0000-0x00000000001E6000-memory.dmp

    Filesize

    24KB

  • memory/3040-26-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB