Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    28/02/2024, 05:33

General

  • Target

    2024-02-28_d1da81770f1004b07a09913e312c198d_cryptolocker.exe

  • Size

    43KB

  • MD5

    d1da81770f1004b07a09913e312c198d

  • SHA1

    1bf7526348be54ee04e59ca99d7a4817a46e1889

  • SHA256

    f1009c63c3f1edb9685face3ea4177c584a53e8942c72c5eaaf3a8225a721b8a

  • SHA512

    88f7383dfc57b8280a7ed7a334505368c8754801a4d70eab776d92a061633d8a88dcee1f9cecac1f6f7e058ed204a557a31cece49115df46867f4c43346b5384

  • SSDEEP

    768:b7o/2n1TCraU6GD1a4Xcn62TUdcuQlqJ51mwojQ:bc/y2lm6Y0AqJ51mwojQ

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-28_d1da81770f1004b07a09913e312c198d_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-28_d1da81770f1004b07a09913e312c198d_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2184
    • C:\Users\Admin\AppData\Local\Temp\rewok.exe
      "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:3016

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\rewok.exe

    Filesize

    43KB

    MD5

    17136c67928f110175865eb7e3462824

    SHA1

    5ac58a017e88f976cb126d81e5281dab5a6ed447

    SHA256

    d71fd2e3962adcd9b9188d6bd4418c67f08d64426e2fbb8bd3f9d404643f7131

    SHA512

    41d462612eca7284d8f8ebeca0098e24d52fb76c716c5b1954cf8932718201612164b13fe4e2de2b766e1be1f157cddaed9447f81583c1b9ea83048fda122318

  • memory/2184-0-0x0000000000280000-0x0000000000286000-memory.dmp

    Filesize

    24KB

  • memory/2184-1-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/2184-8-0x0000000000280000-0x0000000000286000-memory.dmp

    Filesize

    24KB

  • memory/3016-17-0x0000000000490000-0x0000000000496000-memory.dmp

    Filesize

    24KB