Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    21/02/2024, 14:18

General

  • Target

    2024-02-21_fb50b92a05db797d4d9d79235a83129f_cryptolocker.exe

  • Size

    50KB

  • MD5

    fb50b92a05db797d4d9d79235a83129f

  • SHA1

    31795fc9127794aaeb538e7ff57ca318cac55715

  • SHA256

    d148566a8913d46190de342c51df02c1f4db345f978678b3803da207736acd6b

  • SHA512

    ed7162690b82b9198c7293f02efed5eb32bf3e754029a3b137696c6cd1f59c97b244ee0451bebfadab7e1d2846039f52d09e85772f2106682ab749d8fffc4be6

  • SSDEEP

    768:X6LsoEEeegiZPvEhHSG+gp/BtOOtEvwDpjBVaD3E09vxmlcaf:X6QFElP6n+gJBMOtEvwDpjBtExmln

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-21_fb50b92a05db797d4d9d79235a83129f_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-21_fb50b92a05db797d4d9d79235a83129f_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2032
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:2648

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    50KB

    MD5

    76ed47a1e0aa2b1e4d8de9f7d65b8d34

    SHA1

    dd06951f80af5283ec586da45c703854a3b849a0

    SHA256

    48803549e73d521eb730fe071b857625e3040d3fcbfe9bedfe927c22c67f8e1d

    SHA512

    931c9ef2cc2445810c484607c40f44e5d9806a858cf946eb2722ccf771b88bacde6744276f7ca32e5f33acd56822c2294dfde2714e4b0c75f6b25c98a726b973

  • memory/2032-0-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2032-1-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2032-2-0x0000000000470000-0x0000000000476000-memory.dmp

    Filesize

    24KB

  • memory/2648-15-0x00000000001D0000-0x00000000001D6000-memory.dmp

    Filesize

    24KB

  • memory/2648-16-0x0000000000200000-0x0000000000206000-memory.dmp

    Filesize

    24KB