Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    21/04/2024, 04:38

General

  • Target

    2024-04-21_e5a1280f649da9528aa31809e491c347_cryptolocker.exe

  • Size

    46KB

  • MD5

    e5a1280f649da9528aa31809e491c347

  • SHA1

    9a7cc7c834a0413d5c7cc78eb9ffb2528fdd5ad7

  • SHA256

    d62c6030cccf470d6dc03f969aaf8eaf82c6c3680bcc69142141ccc23128fd73

  • SHA512

    e99a8316cf56e2b224c1ccbefff1c666662ec471667f0e5e3f926edcc50dc306a80b715bfd6ea13d1ff9bb2d28c5a6a6ea84dc0eedbff1d7a1d174fec9b38359

  • SSDEEP

    768:79inqyNR/QtOOtEvwDpjBKccJVODvccwDFUu:79mqyNhQMOtEvwDpjBzck1Wx

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • Detection of Cryptolocker Samples 5 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-21_e5a1280f649da9528aa31809e491c347_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-21_e5a1280f649da9528aa31809e491c347_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2064
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:2680

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    46KB

    MD5

    aab04f0c11a5601589d9c596c0fd92eb

    SHA1

    61de610398045ca17a2337333d54e4604e557748

    SHA256

    2857939435516db4cee7a399ad86b646484c51cf4c3d37fa915b53c72486b4d7

    SHA512

    98809e58078369735baf8fd815e63a84a59bc762014c11dccfb4e2c404dba2bd90790eebeee02537ee5291102dc5aba9a634331de4eff572af8e3ebaf9e125fd

  • memory/2064-0-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/2064-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

    Filesize

    24KB

  • memory/2064-2-0x0000000000340000-0x0000000000346000-memory.dmp

    Filesize

    24KB

  • memory/2064-9-0x00000000002C0000-0x00000000002C6000-memory.dmp

    Filesize

    24KB

  • memory/2064-15-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/2064-13-0x0000000000690000-0x000000000069F000-memory.dmp

    Filesize

    60KB

  • memory/2680-17-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/2680-19-0x0000000000480000-0x0000000000486000-memory.dmp

    Filesize

    24KB

  • memory/2680-21-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB