Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    154s
  • max time network
    164s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    09/04/2024, 03:30

General

  • Target

    2024-04-09_1549b492774b17f0e7b565d94c1ecc8c_cryptolocker.exe

  • Size

    54KB

  • MD5

    1549b492774b17f0e7b565d94c1ecc8c

  • SHA1

    186062e260ce03fe6e6c6df1e321d60f3f1b325c

  • SHA256

    1aad327033e01ce8c14231a9bee884da55b390f6bbbf9f809e9785056a25600b

  • SHA512

    e46ee1982a993ae650de0460b1f5be75f56f09f7584ca4c109a78de1776183754ca71617801ea81c72bfdb665ad1715aad5f785b5e95ef2bb97b6d07b39f2e4b

  • SSDEEP

    768:X6LsoEEeegiZPvEhHSG+gp/BtOOtEvwDpjBVaD3E09vaTiSfQaV2LJb5:X6QFElP6n+gJBMOtEvwDpjBtE1yILJF

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-09_1549b492774b17f0e7b565d94c1ecc8c_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-09_1549b492774b17f0e7b565d94c1ecc8c_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2460
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:2504

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    54KB

    MD5

    b273d08fd3b761da0f9efae2fe5d3577

    SHA1

    28a3db82dd729a5730412bc51c469a20cebf6c3c

    SHA256

    d8334315c8314d477c28d78d687a1382289a5045408bfd2808a42b6aa4fac737

    SHA512

    e5050a8d74f10406ff53dcde72cf20c63769126771ab334d78aca2040076fb90f8d52c4a3a427fc7a867aec12c5e895531b542446b3d3d0a61f3340a13124141

  • memory/2460-0-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2460-2-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2460-1-0x0000000000270000-0x0000000000276000-memory.dmp

    Filesize

    24KB

  • memory/2504-15-0x00000000002B0000-0x00000000002B6000-memory.dmp

    Filesize

    24KB

  • memory/2504-19-0x0000000000280000-0x0000000000286000-memory.dmp

    Filesize

    24KB