Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    14/03/2024, 16:36

General

  • Target

    2024-03-14_5457035898adde8b115a2912c633f6fe_cryptolocker.exe

  • Size

    61KB

  • MD5

    5457035898adde8b115a2912c633f6fe

  • SHA1

    74c7dc22dabd0543098eb12764327951d04cbdac

  • SHA256

    3e529dc6a92896354ad633371c5a0fc905d20f01b77ca96ec6ef13cc3a2c8a07

  • SHA512

    4aa2a227af88288ab7fce141d20cd160e16b91ac1158b3e77d6c180f7c8a7cfc6b8d0d82d1458c9ed5172f159fec7c01e6aa4bcb273fa433d0285b3a745df399

  • SSDEEP

    768:z6LsoEEeegiZPvEhHSG+gzum/kLyMro2GtOOtEvwDpj/YMLam5aFr7YOzR80:z6QFElP6n+gKmddpMOtEvwDpj9aYaFA2

Score
9/10
upx

Malware Config

Signatures

  • Detection of CryptoLocker Variants 4 IoCs
  • Detection of Cryptolocker Samples 4 IoCs
  • UPX dump on OEP (original entry point) 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-14_5457035898adde8b115a2912c633f6fe_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-14_5457035898adde8b115a2912c633f6fe_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2180
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:3036

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    61KB

    MD5

    fcb7146365901c4401f4025da4ccff1d

    SHA1

    e73fe23c691102dc297c9abc4d2a4dfc46714e35

    SHA256

    2e06e1150fdc064f2e8808e1becdefd6ae022ffa2770bd9414d57e6b3de3bc5a

    SHA512

    48fcd0926ffe9e0eb063ac565b51daeb5f0f3db8a0078fc042de32a2db2591a2f9913dea1a008b56fa21e7236e106f16d224c1ed32772b37a7ce97665db99574

  • memory/2180-0-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2180-1-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2180-3-0x00000000002B0000-0x00000000002B6000-memory.dmp

    Filesize

    24KB

  • memory/2180-2-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2180-15-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/3036-18-0x0000000000300000-0x0000000000306000-memory.dmp

    Filesize

    24KB

  • memory/3036-17-0x0000000000330000-0x0000000000336000-memory.dmp

    Filesize

    24KB

  • memory/3036-25-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB