Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    21/02/2024, 21:29

General

  • Target

    2024-02-21_4bea69608e676ccdd5d750640a5a62df_cryptolocker.exe

  • Size

    55KB

  • MD5

    4bea69608e676ccdd5d750640a5a62df

  • SHA1

    edb95331af4774c1b1331ba6bd7992b8a8c2b750

  • SHA256

    f98a231b2e8b376424c7a407faf380e16991300e8d383b6170ae3ad1bf22005b

  • SHA512

    d1740a30453b6c12bdf489e2aba0bdee957232552b0eb803b9dee49792d0e2010a413b2933e2c9d230f1baa248721b75a4030940d7d2f98ffbe50b06c7be14bd

  • SSDEEP

    768:79inqyNR/QtOOtEvwDpjBK/iVTab3GRuv3VylSV/Cd9z3F:79mqyNhQMOtEvwDpjBPY7xv3g8SZ

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 4 IoCs
  • Detection of Cryptolocker Samples 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-21_4bea69608e676ccdd5d750640a5a62df_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-21_4bea69608e676ccdd5d750640a5a62df_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:3048
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:3016

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    55KB

    MD5

    944eb87f041dbb7654452cfb417c13bc

    SHA1

    3d6c3c7b8cb455270587d89e71c1546d8c18267a

    SHA256

    0a279ed97c4633deb95abf68a44ec49851f86368166ef870c23845b56c9c7d99

    SHA512

    de838510edfdef9840f0c8e9188cf1d89b1bf7d91418bdebc01b58bc524cd0d22f1ba2efda99729141b92eb4f3c42227829cf6a35e7934bf64bb9f4bf90a36f8

  • memory/3016-16-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/3016-19-0x0000000000440000-0x0000000000446000-memory.dmp

    Filesize

    24KB

  • memory/3016-18-0x0000000000470000-0x0000000000476000-memory.dmp

    Filesize

    24KB

  • memory/3048-0-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/3048-1-0x0000000000320000-0x0000000000326000-memory.dmp

    Filesize

    24KB

  • memory/3048-2-0x0000000000450000-0x0000000000456000-memory.dmp

    Filesize

    24KB

  • memory/3048-3-0x0000000000320000-0x0000000000326000-memory.dmp

    Filesize

    24KB

  • memory/3048-14-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB