Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10/03/2024, 10:29

General

  • Target

    2024-03-10_3161e23a1c465e12253f55145779f03e_cryptolocker.exe

  • Size

    59KB

  • MD5

    3161e23a1c465e12253f55145779f03e

  • SHA1

    ea2be9133b7809a687731716e0f775f2cf21cf97

  • SHA256

    1557541d54a9cf5ced3f1b8feb554e8f5c75adf2e9e5dd5542ffc35486735aed

  • SHA512

    3faa8fc872fc9fac10264fe2d7d798c74f5394778944859b45eef33fc28d695111b40cc1ad8a85fd28d4449bd8e8f0b360e00bd18ca8254112fa5b5f34b324d1

  • SSDEEP

    1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMB:TCjsIOtEvwDpj5HE/OUHnSMC

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • Detection of Cryptolocker Samples 5 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-10_3161e23a1c465e12253f55145779f03e_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-10_3161e23a1c465e12253f55145779f03e_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1460
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Executes dropped EXE
      PID:3036

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    60KB

    MD5

    bd7a9eb3b55de87c51d864f98a2cf983

    SHA1

    3bd112cd6e480df0e3c2811cd815041def70b2b3

    SHA256

    0f8d71732c94975883b893f9548e8d5d75466662353537b3d5d517e0a8cfb86a

    SHA512

    ac572a15cbd0c511a2b7e5236b7867f035e3a6384414eef705fe8004a2f7d9f6a9c3a83e6974fcbf92b7d73c8030517ddbc06480728b94924d0fb26f53872343

  • memory/1460-0-0x0000000000500000-0x000000000050E000-memory.dmp

    Filesize

    56KB

  • memory/1460-1-0x00000000001D0000-0x00000000001D6000-memory.dmp

    Filesize

    24KB

  • memory/1460-2-0x0000000000200000-0x0000000000206000-memory.dmp

    Filesize

    24KB

  • memory/1460-4-0x00000000001D0000-0x00000000001D6000-memory.dmp

    Filesize

    24KB

  • memory/1460-16-0x0000000000500000-0x000000000050E000-memory.dmp

    Filesize

    56KB

  • memory/3036-15-0x0000000000500000-0x000000000050E000-memory.dmp

    Filesize

    56KB

  • memory/3036-19-0x0000000000450000-0x0000000000456000-memory.dmp

    Filesize

    24KB

  • memory/3036-18-0x0000000000420000-0x0000000000426000-memory.dmp

    Filesize

    24KB

  • memory/3036-26-0x0000000000500000-0x000000000050E000-memory.dmp

    Filesize

    56KB