Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    05/04/2024, 12:41

General

  • Target

    2024-04-05_dd9ddcda3edd80c5edfc98a8affa7bf3_cryptolocker.exe

  • Size

    38KB

  • MD5

    dd9ddcda3edd80c5edfc98a8affa7bf3

  • SHA1

    8d35271cf3026f9580da251f975d77d8a84ce831

  • SHA256

    63b98721e65b768178756863e254fb07030f2532952c5a1641f399a4e73c8cc8

  • SHA512

    9521d225ff9c67949fb8c58761492e43d7e5557da70a5910a8289f33649d969e4920146c370cb6e4e651464e04cb1f0e2dd46eb8685ac34ce12b789fedb8630d

  • SSDEEP

    768:bxNQIE0eBhkL2Fo1CCwgfjOg1tsJ6zeen7JEgx3v:bxNrC7kYo1Fxf3s06g5

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-05_dd9ddcda3edd80c5edfc98a8affa7bf3_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-05_dd9ddcda3edd80c5edfc98a8affa7bf3_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2180
    • C:\Users\Admin\AppData\Local\Temp\pissa.exe
      "C:\Users\Admin\AppData\Local\Temp\pissa.exe"
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      PID:2024

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\pissa.exe

    Filesize

    38KB

    MD5

    3010f21f09e8c1030c2db6e6481059dd

    SHA1

    61861ef6ec38e1333c4c3c15e0b504988f224bb9

    SHA256

    38d22d1a53190aaa400f561da737c5c8bb5f24bfb1c46cf4a38711c76a344213

    SHA512

    103a3c96d81b00584f89d06f76c322abf06b5cf8e4f873126c1e515427696e91461893abea3dcbb8e9db26c6220b5e1b3fd453e487e097f20c38a19059a62aa1

  • memory/2024-15-0x00000000003B0000-0x00000000003B6000-memory.dmp

    Filesize

    24KB

  • memory/2024-19-0x00000000003A0000-0x00000000003A6000-memory.dmp

    Filesize

    24KB

  • memory/2180-0-0x00000000004D0000-0x00000000004D6000-memory.dmp

    Filesize

    24KB

  • memory/2180-1-0x00000000004E0000-0x00000000004E6000-memory.dmp

    Filesize

    24KB

  • memory/2180-8-0x00000000004D0000-0x00000000004D6000-memory.dmp

    Filesize

    24KB