Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    15/03/2024, 14:00

General

  • Target

    2024-03-15_b770e8ad27d31f66406b50840bbb9c83_cryptolocker.exe

  • Size

    65KB

  • MD5

    b770e8ad27d31f66406b50840bbb9c83

  • SHA1

    98e07a7786ff65e1d9c558e6648c5f267a24ed1e

  • SHA256

    023a9fbd9a2e7d09093a3092719e3fb513ca5ac2dc26387527317c14a24b5d3a

  • SHA512

    e8f3757a408b2236d59ffb58c21d7ad4f5ac72181ccee6455213ef0ebc531601a9ce7c65f9c5294236ec55738f6d7353243864f23c02c2b6224742b5577f9258

  • SSDEEP

    1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszudnYTjipvF293vaRLh:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7A

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-15_b770e8ad27d31f66406b50840bbb9c83_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-15_b770e8ad27d31f66406b50840bbb9c83_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2908
    • C:\Users\Admin\AppData\Local\Temp\hurok.exe
      "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:3024

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\hurok.exe

    Filesize

    65KB

    MD5

    d124c42860ac1d72c9cf4009fd372117

    SHA1

    e9d9e801a645a8ad750a8d9ee7301e01f1c4a1cb

    SHA256

    fa60a6d2b0492b287506c2e02ca016e688d15f2bc209aaf79f75e34309badcb5

    SHA512

    da358b0657074a25c038e66c1b516caaabdc29e458cfa78b8166fdfea9515db867000d93d55958c1df898495dbdd7edd94c1d3bf4d44a496ec14aa172ec4ad5a

  • memory/2908-0-0x0000000000320000-0x0000000000326000-memory.dmp

    Filesize

    24KB

  • memory/2908-2-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/2908-1-0x0000000000320000-0x0000000000326000-memory.dmp

    Filesize

    24KB

  • memory/3024-17-0x0000000000310000-0x0000000000316000-memory.dmp

    Filesize

    24KB