Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    17/02/2024, 07:59

General

  • Target

    2024-02-17_f646033e48e8e830b55e8183f5d51208_cryptolocker.exe

  • Size

    59KB

  • MD5

    f646033e48e8e830b55e8183f5d51208

  • SHA1

    a643679e78dd1a444f256210a203f4d3e8b71719

  • SHA256

    01c5a555c72a60eca9d5a9e9f4e70c155850b8a070e644bb03287e2eb4247527

  • SHA512

    7924e7b333333cb74f54c6f368e1df3f0765e55e8cd6288c6d6df767abdf1aa0248ca4f6505ea2c8dc7f1344e5b9c228732248bd4eed27b7ff4d46584dbbfffa

  • SSDEEP

    1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMd3:TCjsIOtEvwDpj5HE/OUHnSM2

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 6 IoCs
  • Detection of Cryptolocker Samples 5 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-17_f646033e48e8e830b55e8183f5d51208_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-17_f646033e48e8e830b55e8183f5d51208_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2288
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Executes dropped EXE
      PID:2456

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    59KB

    MD5

    a25052a3f36655b0e7c3b1ca7af87476

    SHA1

    5a24661937f13aff112dccb8588c4167c72e3fb1

    SHA256

    1a5f7ed6780954d7591c08ea9862ea3b7db6c4ae22428581be59175d3fde2f44

    SHA512

    57e4bfc51bb57920dfd0d515edc75a2418d40d9ee510e2c154a8662a0abdf6ab447897d6ec9b85488a1d3906681eb95972ef2c536bdd0b0c71e1dd202072d582

  • memory/2288-0-0x0000000000500000-0x000000000050E000-memory.dmp

    Filesize

    56KB

  • memory/2288-1-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2288-2-0x0000000000360000-0x0000000000366000-memory.dmp

    Filesize

    24KB

  • memory/2288-4-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2288-13-0x0000000002480000-0x000000000248E000-memory.dmp

    Filesize

    56KB

  • memory/2288-15-0x0000000000500000-0x000000000050E000-memory.dmp

    Filesize

    56KB

  • memory/2456-17-0x0000000000500000-0x000000000050E000-memory.dmp

    Filesize

    56KB

  • memory/2456-19-0x0000000000450000-0x0000000000456000-memory.dmp

    Filesize

    24KB

  • memory/2456-21-0x0000000000320000-0x0000000000326000-memory.dmp

    Filesize

    24KB

  • memory/2456-27-0x0000000000500000-0x000000000050E000-memory.dmp

    Filesize

    56KB