Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    23/02/2024, 15:01

General

  • Target

    2024-02-23_531b1f068781d8d656db25dae5a04895_cryptolocker.exe

  • Size

    88KB

  • MD5

    531b1f068781d8d656db25dae5a04895

  • SHA1

    15b4a519f48dc903dbe6eb197e3a4b21872c915f

  • SHA256

    b6eff88fe5c80a21524ddf67a0f68529fb648196eada34849898094e2bda086f

  • SHA512

    fcaee05173c711b3e2a16a625b11158a47bc7f37b4104e77dc134adbd66adf1a1aabda578c53940a10092ef758f0c6dd217433bbc515577f888b220265724db5

  • SSDEEP

    1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwMgL9:AnBdOOtEvwDpj6zF

Score
9/10
upx

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • Detection of Cryptolocker Samples 5 IoCs
  • UPX dump on OEP (original entry point) 5 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-23_531b1f068781d8d656db25dae5a04895_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-23_531b1f068781d8d656db25dae5a04895_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:3028
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:2380

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    88KB

    MD5

    0ebaec12b219817bde124eaae0c2c260

    SHA1

    2a97f87ebecf6eee65b41f73f246a4e4278eb2f5

    SHA256

    77cf44c51ad2f489f2a12affbd37241d316b376ad4f12d56a09a795c262d53ad

    SHA512

    66075db413dd74e4030e399f53819a5f9d6b3fd7f5e95c0afc1df43b1be9b5cad185d6004e5e8e3a1627fc93751328eb8900bd58fe5506e7dba9120bc20de3f1

  • memory/2380-18-0x00000000004A0000-0x00000000004A6000-memory.dmp

    Filesize

    24KB

  • memory/2380-17-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/2380-20-0x0000000000300000-0x0000000000306000-memory.dmp

    Filesize

    24KB

  • memory/2380-26-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/3028-1-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/3028-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

    Filesize

    24KB

  • memory/3028-2-0x0000000000210000-0x0000000000216000-memory.dmp

    Filesize

    24KB

  • memory/3028-9-0x00000000001D0000-0x00000000001D6000-memory.dmp

    Filesize

    24KB

  • memory/3028-15-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB