Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    170s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    29/02/2024, 05:44

General

  • Target

    2024-02-29_94d580260683ab09d1159ad78fa33906_cryptolocker.exe

  • Size

    43KB

  • MD5

    94d580260683ab09d1159ad78fa33906

  • SHA1

    89b2ad54c54641f75bc9f3340d0bd364be957e87

  • SHA256

    d020005b946117a2f020fdfd9451b9358946ccf3b9c6f1a0773fc73fb4dd398a

  • SHA512

    cd8e0a2133936493d4c438a2d77eb1cfa198813bac844b1f39a73d64a4eb670a3af75b3c5f500452604880566e5ea0cb20c371b6dcdb3025670d1da739cd247a

  • SSDEEP

    768:bIDOw9UiaCHfjnE0Sf88AvvP1oghYvm9/6D8jnPxBIGJL:bIDOw9a0Dwo3P1ojvUSD4PXIGF

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-29_94d580260683ab09d1159ad78fa33906_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-29_94d580260683ab09d1159ad78fa33906_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2056
    • C:\Users\Admin\AppData\Local\Temp\lossy.exe
      "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
      2⤵
      • Executes dropped EXE
      PID:1788

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\lossy.exe

    Filesize

    43KB

    MD5

    0e48e136861d4287f513b66e24e9facb

    SHA1

    209beed957a8723f9877abcca56662aeed0abbf9

    SHA256

    4564b3cccbd8bb8c6ce8ce070aad0addfc511bab82b20285ca598f6e8e7cd017

    SHA512

    a110864fc40b855c6d6da89a9f55c673a3b7ab205209ec548f59aa5733ddd29bbc4f626ad075cbba9e0460e30f4866eaa9c6670186051fed3cb66fb0792d9fec

  • memory/2056-0-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2056-1-0x0000000000270000-0x0000000000276000-memory.dmp

    Filesize

    24KB

  • memory/2056-2-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB