Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    05/03/2024, 21:32

General

  • Target

    2024-03-05_41e1899ad2339a6b7aab49214515421d_cryptolocker.exe

  • Size

    53KB

  • MD5

    41e1899ad2339a6b7aab49214515421d

  • SHA1

    d8317f4995ff72be638c5d32ef81d700ac6b5f06

  • SHA256

    553ae1b418199f5c21ee4c7533043de2add0edad3ed271dcfbb137cb0cf35e21

  • SHA512

    3a8459bfff195606bb2da0da5b3dce109eafdaa67fe667e279bb217097b09f88186bbfbeaa1cc805600282c211bc2c9c11eb70001168c2088ce5cf8a65a04214

  • SSDEEP

    768:bIDOw9UiaCHfjnE0Sfa7ilR0p9u6p4ICNBCXK9XbTbmhTyms:bIDOw9a0DwitDZzcT2s

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-05_41e1899ad2339a6b7aab49214515421d_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-05_41e1899ad2339a6b7aab49214515421d_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2912
    • C:\Users\Admin\AppData\Local\Temp\lossy.exe
      "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
      2⤵
      • Executes dropped EXE
      PID:2904

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\lossy.exe

    Filesize

    54KB

    MD5

    00de1b62308bc5b403bdb92213aa531b

    SHA1

    a1eb6534c275f4782195ec76bac27ff3e05ab373

    SHA256

    6d2409b6b4b1ee2ea2b6bf12b53c1f92409ec4ba7af44e7621a7cf789c274519

    SHA512

    c136900e49fbb97b61bb582f2ea654d6cdce6b36007261803a47e6fd956b7fcfe2768dcfbd840a7e3580ef0b1232b5d73f8a7d24bf7438d480aaa987bf0f6c78

  • memory/2904-16-0x0000000000320000-0x0000000000326000-memory.dmp

    Filesize

    24KB

  • memory/2904-15-0x0000000000580000-0x0000000000586000-memory.dmp

    Filesize

    24KB

  • memory/2912-0-0x0000000001C50000-0x0000000001C56000-memory.dmp

    Filesize

    24KB

  • memory/2912-1-0x0000000001C90000-0x0000000001C96000-memory.dmp

    Filesize

    24KB

  • memory/2912-8-0x0000000001C50000-0x0000000001C56000-memory.dmp

    Filesize

    24KB