Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    18/02/2024, 14:47

General

  • Target

    2024-02-18_cdfb7ef0c116dd9ec2409b337b56cee0_cryptolocker.exe

  • Size

    125KB

  • MD5

    cdfb7ef0c116dd9ec2409b337b56cee0

  • SHA1

    3946ab6c3169406bc7efa2e255c562bc125ce360

  • SHA256

    889abd290b440b07d6fbda9603893f221a04dbab168314f1a0798a3b63cfc934

  • SHA512

    bbdcdf65f0ce7dacb2e14bf1f9a0b33da8428eaeed37ad389341d438c104c4c20aefd8e2af60e55fd500ce560743ce71c662ac165de92bdfaabab930d87d453a

  • SSDEEP

    1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgp699GNtL1eU:AnBdOOtEvwDpj6za

Score
9/10
upx

Malware Config

Signatures

  • Detection of CryptoLocker Variants 6 IoCs
  • Detection of Cryptolocker Samples 6 IoCs
  • UPX dump on OEP (original entry point) 6 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-18_cdfb7ef0c116dd9ec2409b337b56cee0_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-18_cdfb7ef0c116dd9ec2409b337b56cee0_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2316
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:1948

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    126KB

    MD5

    4397bb2d1f5dc633010daef9ce5e1edc

    SHA1

    ce1ad5053d7325b49a7a67f385404c658d81cfb4

    SHA256

    f91892f625deebacf6f97962397bd41bfc88015cc3e13d8bdf450b24246a995a

    SHA512

    8cfb436a3caea64c4599742b585d8f4f6165a570f802724c1209cf917c5d4bfc06803568c77647cd2e35946867879d2fa3d166c27e82962d6daa17e58a03bb65

  • memory/1948-17-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/1948-19-0x0000000000210000-0x0000000000216000-memory.dmp

    Filesize

    24KB

  • memory/1948-26-0x00000000001D0000-0x00000000001D6000-memory.dmp

    Filesize

    24KB

  • memory/1948-27-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/2316-0-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/2316-1-0x00000000003B0000-0x00000000003B6000-memory.dmp

    Filesize

    24KB

  • memory/2316-2-0x0000000000410000-0x0000000000416000-memory.dmp

    Filesize

    24KB

  • memory/2316-9-0x00000000003B0000-0x00000000003B6000-memory.dmp

    Filesize

    24KB

  • memory/2316-15-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/2316-12-0x00000000022E0000-0x00000000022EF000-memory.dmp

    Filesize

    60KB