Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    11/03/2024, 01:33

General

  • Target

    2024-03-11_9bbc3654bf035bf853d9d15d3864b2bc_cryptolocker.exe

  • Size

    49KB

  • MD5

    9bbc3654bf035bf853d9d15d3864b2bc

  • SHA1

    500a4b8253adc2b189401d3be3059e4104ebe2c6

  • SHA256

    48a489e581639a66722b8c08dad46a77be4f106ac44903100f86ef3cae4ce421

  • SHA512

    96b44c20f8c46a56eb6d13cabf1ce7422cb60cef6ba6c91e80dd5e9d9f9a14bf57f34ff3751d7ad1f4a328e3404653b7c6bf506bcb7aec230d09b2e29b289072

  • SSDEEP

    1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb6Impy1:BbdDmjr+OtEvwDpjMy

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • Detection of Cryptolocker Samples 4 IoCs
  • UPX dump on OEP (original entry point) 5 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-11_9bbc3654bf035bf853d9d15d3864b2bc_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-11_9bbc3654bf035bf853d9d15d3864b2bc_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1724
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:2548

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    49KB

    MD5

    913f703825c034341e1dc23af23a5274

    SHA1

    56e59ff7cb9f9119ac985d7e80f524251bf5df2d

    SHA256

    3d4caaeee1af84493e1c4c765a50e323519fe12a98d4107fec545221912e6a0e

    SHA512

    e2bd569af040a353d73a335fbc0c971e8bc6e2a75e84a26a0e3f0b96c105da0389980162a5dc744a922ebe7f9c3ea3d11739be689969bb28bca93784eee12385

  • memory/1724-1-0x0000000000300000-0x0000000000306000-memory.dmp

    Filesize

    24KB

  • memory/1724-0-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/1724-2-0x0000000000330000-0x0000000000336000-memory.dmp

    Filesize

    24KB

  • memory/1724-5-0x0000000000300000-0x0000000000306000-memory.dmp

    Filesize

    24KB

  • memory/1724-15-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2548-16-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2548-18-0x00000000004A0000-0x00000000004A6000-memory.dmp

    Filesize

    24KB

  • memory/2548-20-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2548-26-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB