Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    19/02/2024, 16:32

General

  • Target

    2024-02-19_47c4247d2567fa83d57457635cde28f6_cryptolocker.exe

  • Size

    97KB

  • MD5

    47c4247d2567fa83d57457635cde28f6

  • SHA1

    faef6e6e28b426d082d1165677e5ee0cf875320a

  • SHA256

    cc4bafdf471b56d9765d7d8982f5d23cb2ef0d439099e8d2751ab41678765244

  • SHA512

    a617bd2c46b93d405886df36c1acc9308ff7b82fd63a6dbd47798a127dca4b9073f71f4ea5ec623f269ab5b95a741ea1ab6b6919eebd87b11b07205877236eeb

  • SSDEEP

    1536:26QFElP6n+gBQMOtEvwDpjQGYQbN/PKwNCJF:26a+2OtEvwDpjtzI

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\asih.exe
    "C:\Users\Admin\AppData\Local\Temp\asih.exe"
    1⤵
    • Executes dropped EXE
    PID:2648
  • C:\Users\Admin\AppData\Local\Temp\2024-02-19_47c4247d2567fa83d57457635cde28f6_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-19_47c4247d2567fa83d57457635cde28f6_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1740

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    97KB

    MD5

    085ddca8e72103f9a1e37b86d552f20f

    SHA1

    8f39dd835fa313141f8d5c7095fc41446a96dc1f

    SHA256

    47c813ae6863951d9b6ef6838f79fe20f221145b6783de31ba8709f7f4018202

    SHA512

    823e8b423b272d5f092f23618fa8b2dc03d3084de0697b48f8e4caa3dbff782331f0a986a94b16880aec96932efc5de969d3bd82f21606556468b14563c536c7

  • memory/1740-1-0x0000000000280000-0x0000000000286000-memory.dmp

    Filesize

    24KB

  • memory/1740-8-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/1740-0-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2648-22-0x00000000002C0000-0x00000000002C6000-memory.dmp

    Filesize

    24KB

  • memory/2648-15-0x0000000000310000-0x0000000000316000-memory.dmp

    Filesize

    24KB