Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    09/04/2024, 01:42 UTC

General

  • Target

    2024-04-09_1e5c64084733f9d7c5b5493a26bbdecc_cryptolocker.exe

  • Size

    52KB

  • MD5

    1e5c64084733f9d7c5b5493a26bbdecc

  • SHA1

    732f41005ef062ab17dcd46d2334c92ff4b8534d

  • SHA256

    4f97c35cb6101e48c1b1073d0e9729426dad3f225da3551328fcb56e928ebdec

  • SHA512

    0bf6e6e5d87858ffd962fa817976ea86912fc62becbcccac1cfbe46a45e9bfb326d0b7718868eb75bbc91400626bc708b39d65a7c7d053d312dcae1ac1785139

  • SSDEEP

    1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb6ImpyeW:BbdDmjr+OtEvwDpjME

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • Detection of Cryptolocker Samples 3 IoCs
  • UPX dump on OEP (original entry point) 5 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-09_1e5c64084733f9d7c5b5493a26bbdecc_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-09_1e5c64084733f9d7c5b5493a26bbdecc_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2200
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:2180

Network

  • flag-us
    DNS
    emrlogistics.com
    asih.exe
    Remote address:
    8.8.8.8:53
    Request
    emrlogistics.com
    IN A
    Response
    emrlogistics.com
    IN CNAME
    traff-1.hugedomains.com
    traff-1.hugedomains.com
    IN CNAME
    hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com
    hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com
    IN A
    52.71.57.184
    hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com
    IN A
    54.209.32.212
  • 52.71.57.184:443
    emrlogistics.com
    asih.exe
    152 B
    3
  • 54.209.32.212:443
    emrlogistics.com
    asih.exe
    152 B
    3
  • 52.71.57.184:443
    emrlogistics.com
    asih.exe
    152 B
    3
  • 54.209.32.212:443
    emrlogistics.com
    asih.exe
    152 B
    3
  • 52.71.57.184:443
    emrlogistics.com
    asih.exe
    152 B
    3
  • 54.209.32.212:443
    emrlogistics.com
    asih.exe
    152 B
    3
  • 52.71.57.184:443
    emrlogistics.com
    asih.exe
    152 B
    3
  • 54.209.32.212:443
    emrlogistics.com
    asih.exe
    52 B
    1
  • 8.8.8.8:53
    emrlogistics.com
    dns
    asih.exe
    62 B
    192 B
    1
    1

    DNS Request

    emrlogistics.com

    DNS Response

    52.71.57.184
    54.209.32.212

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    52KB

    MD5

    21f433bb1d00ae02ba52b7823d8109c1

    SHA1

    cc018683ed549fe7d13073d26fab73d147528690

    SHA256

    c1b8dfa36ec4a8a28846dc50de9ef84e90d835112dbe66bcb55b79e9cd04c8c4

    SHA512

    c94ea3dd118c3a0a0cd0ea9f56cadbb9e271056bdda39f8cd675ba8df65dd2aa66f58d04112985dbf0c5371a912be9cb83ac0cd48fd49b09932d7c61f5c62f71

  • memory/2180-17-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2180-22-0x00000000002C0000-0x00000000002C6000-memory.dmp

    Filesize

    24KB

  • memory/2180-19-0x00000000005F0000-0x00000000005F6000-memory.dmp

    Filesize

    24KB

  • memory/2180-27-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2200-0-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2200-1-0x0000000000250000-0x0000000000256000-memory.dmp

    Filesize

    24KB

  • memory/2200-3-0x0000000000250000-0x0000000000256000-memory.dmp

    Filesize

    24KB

  • memory/2200-2-0x0000000000280000-0x0000000000286000-memory.dmp

    Filesize

    24KB

  • memory/2200-15-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2200-13-0x0000000001F60000-0x0000000001F70000-memory.dmp

    Filesize

    64KB

  • memory/2200-28-0x0000000001F60000-0x0000000001F70000-memory.dmp

    Filesize

    64KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.