Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

2024-03-18...er.exe

windows7-x64

9

2024-03-18...er.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    18/03/2024, 12:45 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-03-18_ad3a5c4dc76f90148182a97950a5ced6_cryptolocker.exe

  • Size

    123KB

  • MD5

    ad3a5c4dc76f90148182a97950a5ced6

  • SHA1

    e0047e62e75fa0b949e13bd58f049688c24e23e5

  • SHA256

    18d8c6c9186603aaa63619ea01d5289649ceff3ce2732aa9f2e5ac9fdba782f8

  • SHA512

    4b1a54d41eda93cc3cf33b8d96a5528e78a4e075b79694dc6130ce9bf655bd01f2ad48b126918ed120b12f213b7eba92192c465e9978b8cf97a51dc62db40b3e

  • SSDEEP

    1536:gUj+AIMOtEvwDpjNbwQEIPlemUhYwkkxE4Mqbad:vCA9OtEvwDpjP

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-18_ad3a5c4dc76f90148182a97950a5ced6_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-18_ad3a5c4dc76f90148182a97950a5ced6_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1964
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Executes dropped EXE
      PID:2692

Network

  • flag-us
    DNS
    bestccc.com
    misid.exe
    Remote address:
    8.8.8.8:53
    Request
    bestccc.com
    IN A
    Response
    bestccc.com
    IN A
    103.14.121.240
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    594 B
     219 B
     6
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    446 B
     259 B
     7
    6
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    388 B
     215 B
     7
    5
  • 103.14.121.240:443
    bestccc.com
    misid.exe
    190 B
     92 B
     4
    2
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    686 B
     231 B
     8
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    406 B
     219 B
     6
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    288 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    misid.exe
    190 B
     92 B
     4
    2
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    392 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    354 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    288 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    misid.exe
    236 B
     132 B
     5
    3
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    392 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    354 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    288 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    misid.exe
    190 B
     132 B
     4
    3
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    484 B
     259 B
     7
    6
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    406 B
     219 B
     6
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    288 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    misid.exe
    190 B
     92 B
     4
    2
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    392 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    354 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    288 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    misid.exe
    190 B
     92 B
     4
    2
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    392 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    518 B
     219 B
     6
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    288 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    misid.exe
    236 B
     144 B
     5
    3
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    594 B
     219 B
     6
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    354 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    288 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    misid.exe
    190 B
     92 B
     4
    2
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    438 B
     219 B
     6
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    354 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    426 B
     259 B
     8
    6
  • 103.14.121.240:443
    bestccc.com
    misid.exe
    242 B
     92 B
     5
    2
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    392 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    354 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    386 B
     219 B
     6
    5
  • 103.14.121.240:443
    bestccc.com
    misid.exe
    190 B
     92 B
     4
    2
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    392 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    446 B
     259 B
     7
    6
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    340 B
     219 B
     6
    5
  • 103.14.121.240:443
    bestccc.com
    misid.exe
    334 B
     144 B
     7
    3
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    492 B
     215 B
     7
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    354 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    288 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    misid.exe
    236 B
     132 B
     5
    3
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    392 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    354 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    288 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    misid.exe
    236 B
     92 B
     5
    2
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    444 B
     219 B
     6
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    518 B
     219 B
     6
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    288 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    misid.exe
    236 B
     132 B
     5
    3
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    594 B
     219 B
     6
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    354 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    288 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    misid.exe
    190 B
     92 B
     4
    2
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    392 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    406 B
     219 B
     6
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    288 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    misid.exe
    236 B
     132 B
     5
    3
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    444 B
     219 B
     6
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    354 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    288 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    misid.exe
    236 B
     92 B
     5
    2
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    444 B
     219 B
     6
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    452 B
     186 B
     7
    4
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    490 B
     271 B
     8
    6
  • 103.14.121.240:443
    bestccc.com
    misid.exe
    190 B
     92 B
     4
    2
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    392 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    898 B
     271 B
     9
    6
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    288 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    misid.exe
    190 B
     92 B
     4
    2
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    392 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    354 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    288 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    misid.exe
    236 B
     92 B
     5
    2
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    746 B
     263 B
     9
    6
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    518 B
     219 B
     6
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    524 B
     259 B
     9
    6
  • 103.14.121.240:443
    bestccc.com
    misid.exe
    242 B
     92 B
     5
    2
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    392 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    354 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    334 B
     259 B
     6
    6
  • 103.14.121.240:443
    bestccc.com
    misid.exe
    190 B
     92 B
     4
    2
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    392 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    354 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    288 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    misid.exe
    334 B
     184 B
     7
    4
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    490 B
     219 B
     7
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    406 B
     219 B
     6
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    334 B
     179 B
     6
    4
  • 103.14.121.240:443
    bestccc.com
    misid.exe
    236 B
     132 B
     5
    3
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    392 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    734 B
     271 B
     8
    6
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    288 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    misid.exe
    334 B
     144 B
     7
    3
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    444 B
     219 B
     6
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    630 B
     219 B
     11
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    340 B
     219 B
     6
    5
  • 103.14.121.240:443
    bestccc.com
    misid.exe
    282 B
     172 B
     6
    4
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    594 B
     219 B
     6
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    610 B
     259 B
     8
    6
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    386 B
     219 B
     7
    5
  • 103.14.121.240:443
    bestccc.com
    misid.exe
    340 B
     144 B
     7
    3
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    444 B
     219 B
     6
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    518 B
     219 B
     6
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    288 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    misid.exe
    190 B
     92 B
     4
    2
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    392 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    354 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    288 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    misid.exe
    236 B
     132 B
     5
    3
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    392 B
     219 B
     5
    5
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    492 B
     259 B
     8
    6
  • 103.14.121.240:443
    bestccc.com
    tls
    misid.exe
    340 B
     219 B
     6
    5
  • 103.14.121.240:443
    bestccc.com
    misid.exe
    190 B
     92 B
     4
    2
  • 103.14.121.240:443
    bestccc.com
    misid.exe
    52 B
     1
  • 8.8.8.8:53
    bestccc.com
    dns
    misid.exe
    57 B
     73 B
     1
    1

    DNS Request

    bestccc.com

    DNS Response

    103.14.121.240

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\misid.exe
    Filesize

    124KB

    MD5

    cae3792f4489f4913da0f9c38ec5ecfb

    SHA1

    50dfd394e90b5182097cde8d4a486cb87bff231a

    SHA256

    f956daf5edc61cb4b51fcb2dbbe41ed65cfa5bfb26c2b7943b2070a4e9c9ff2d

    SHA512

    4c3165b6d6355ba75261b632ad362cafd33d0fc6c806d5a85282f32d6170b5957282d49d00af75d1dc8033672841bd91b7959e0a52d5888660ada791ead6c164

    Download Submit

  • memory/1964-0-0x0000000000320000-0x0000000000326000-memory.dmp

    Filesize

    24KB

    Download

  • memory/1964-1-0x0000000000350000-0x0000000000356000-memory.dmp

    Filesize

    24KB

    Download

  • memory/1964-3-0x0000000000320000-0x0000000000326000-memory.dmp

    Filesize

    24KB

    Download

  • memory/2692-15-0x0000000000450000-0x0000000000456000-memory.dmp

    Filesize

    24KB

    Download

  • memory/2692-17-0x0000000000420000-0x0000000000426000-memory.dmp

    Filesize

    24KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.