Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20240319-en
  • resource tags

    arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
  • submitted
    17/04/2024, 03:39

General

  • Target

    2024-04-17_4bb5eec13b3cc707961f391b3af60be9_cryptolocker.exe

  • Size

    388KB

  • MD5

    4bb5eec13b3cc707961f391b3af60be9

  • SHA1

    d25785479cee9da95cc0d65ccbbcf262651dbe58

  • SHA256

    b23f8f4ce6712274e8b6200a35b112d02a867c0819a94ee3feaa736475f6fc11

  • SHA512

    28142373e2aa466432bc1c6365e9ece1bbfb0b157d2957dd3678737b01da74ad61d38503d8afaa3a468ed666e586e03e3998143ebfdf0161afb211163ec5e8e6

  • SSDEEP

    6144:nnOsaQgAOjvrZFODJjBz3j1jTqQy6v2GGnugOtihzXU:nnOflT/ZFIjBz3xjTxynGUOUhXU

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-17_4bb5eec13b3cc707961f391b3af60be9_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-17_4bb5eec13b3cc707961f391b3af60be9_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1728
    • C:\Users\Admin\AppData\Local\Temp\hasfj.exe
      "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
      2⤵
      • Executes dropped EXE
      PID:2204

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\hasfj.exe

    Filesize

    388KB

    MD5

    2ff3b67b8918244f60d2968b2965285d

    SHA1

    2d00e0941e35b97a7772da13f96b5ef1448f61aa

    SHA256

    b75420043e48843464e4052e0990a0fdc34fb7b89f174db2288d3f3a460d95bd

    SHA512

    c708a14e54204a14060819a14427040e9fb447a790d061f10de62922e96d50ea3527b81848eb9fbdd9ee3f0db29d93264dcebf38ab7f0fbe1c48d902a06aed45

  • memory/1728-0-0x0000000000490000-0x0000000000496000-memory.dmp

    Filesize

    24KB

  • memory/1728-1-0x00000000004B0000-0x00000000004B6000-memory.dmp

    Filesize

    24KB

  • memory/1728-2-0x0000000000490000-0x0000000000496000-memory.dmp

    Filesize

    24KB

  • memory/2204-15-0x0000000000590000-0x0000000000596000-memory.dmp

    Filesize

    24KB

  • memory/2204-19-0x0000000000360000-0x0000000000366000-memory.dmp

    Filesize

    24KB