Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20240319-en
  • resource tags

    arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
  • submitted
    19/03/2024, 23:40

General

  • Target

    2024-03-19_ad5faca8181b4ca1dfdf2491dc002785_cryptolocker.exe

  • Size

    100KB

  • MD5

    ad5faca8181b4ca1dfdf2491dc002785

  • SHA1

    422d62c0195909e05926f06f20c77e45331145b1

  • SHA256

    e01c52cf9769af13754c1c4b5a89fdc60ce01a4367eb48b49f47e5fa9ea6b420

  • SHA512

    c1ecf5b4a67b22beb8f72367ed429855b91b00af4c1ecfc7dfd1ce9e7eec29ff556fcdaf344e212d570cc9f15c706e9f84c02c5352c1b315871f8a0d6ccc3baf

  • SSDEEP

    1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgpwqWsviPy1Q:AnBdOOtEvwDpj6z5

Score
9/10
upx

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • Detection of Cryptolocker Samples 5 IoCs
  • UPX dump on OEP (original entry point) 5 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-19_ad5faca8181b4ca1dfdf2491dc002785_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-19_ad5faca8181b4ca1dfdf2491dc002785_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2140
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:2924

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    100KB

    MD5

    1df3eb135b008369a36132d2dc1d3f0d

    SHA1

    89834476cbd9f9542117841157acbd2a5fff0bc2

    SHA256

    5b80f7079a70a074b9054760eaea2ffe575a328725195c5cf178639e27d99f4f

    SHA512

    c7dc7cd579b5415d53db83eec49e7a30e4bbcbb456aeccf86fb472f986a1ce665880a0783121b10efd6dd9de051818ef79125165b8f6207a79be7607c69c421a

  • memory/2140-0-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/2140-1-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2140-2-0x00000000002F0000-0x00000000002F6000-memory.dmp

    Filesize

    24KB

  • memory/2140-3-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2140-15-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/2924-16-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/2924-18-0x0000000000510000-0x0000000000516000-memory.dmp

    Filesize

    24KB

  • memory/2924-25-0x00000000002C0000-0x00000000002C6000-memory.dmp

    Filesize

    24KB

  • memory/2924-26-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB