Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    15/04/2024, 06:17

General

  • Target

    2024-04-15_9fd43833539715112d53672d2faaf0e3_cryptolocker.exe

  • Size

    52KB

  • MD5

    9fd43833539715112d53672d2faaf0e3

  • SHA1

    304e26eecad0877dcfe25a36bb58869d7a2b24ad

  • SHA256

    c6571313fc037f55934d90568bdea1594c54031773a1b5e315cabd54b4b7988b

  • SHA512

    0b419e405b1a0119ba40d016ba90bed66fb45755b852222316219fbe462e98733dfe866086ef77be695e62345481eafbf852327082fd98b456a07871c6c296b6

  • SSDEEP

    1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszsbKY1xzpAIX6EB:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7A

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-15_9fd43833539715112d53672d2faaf0e3_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-15_9fd43833539715112d53672d2faaf0e3_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2168
    • C:\Users\Admin\AppData\Local\Temp\hurok.exe
      "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2556

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\hurok.exe

    Filesize

    52KB

    MD5

    bde23b4354cea13b77109faeb7674fbb

    SHA1

    b7a0fdfd24a1d1d5833bb09cce9b47b2f63a8d05

    SHA256

    e72736a81da5804eb03a07a068ca7ccce54f1c783e542cd961ac4fe92d983b86

    SHA512

    65bc4a786c177824a5fdf7faa56678f33f04d392a3e0f634c5a5c80a7ba573d564d1fbe930ffde772c2fb751489027e79cf04902c794172c97c2b6b17ed90124

  • memory/2168-0-0x0000000000230000-0x0000000000236000-memory.dmp

    Filesize

    24KB

  • memory/2168-1-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/2168-8-0x0000000000230000-0x0000000000236000-memory.dmp

    Filesize

    24KB