Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    22/04/2024, 10:59

General

  • Target

    2024-04-22_be602adfd437ff555964cbf8c52b82c9_cryptolocker.exe

  • Size

    41KB

  • MD5

    be602adfd437ff555964cbf8c52b82c9

  • SHA1

    c62fbc5a4c892c5787c40ec903b9d0a2cc9475d7

  • SHA256

    5f672a3191b1ffba988862a2c5e9a97bcfa797f780c5878787947528244dd9c4

  • SHA512

    08ccb11744d18275c40f7a9e13c88fe5a99a1e960a45b55ad44e849f273150d5cdbcdf5a6425ab571a42de6627f9971b1074b41f00efae377e489b3afb645af3

  • SSDEEP

    768:bIDOw9UiaCHfjnE0Sf88AvvP1oghYvm9/6DyE9x3e:bIDOw9a0Dwo3P1ojvUSD79Re

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-22_be602adfd437ff555964cbf8c52b82c9_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-22_be602adfd437ff555964cbf8c52b82c9_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2060
    • C:\Users\Admin\AppData\Local\Temp\lossy.exe
      "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
      2⤵
      • Executes dropped EXE
      PID:3036

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\lossy.exe

    Filesize

    41KB

    MD5

    db6274dea317b44751cd6ec8747d4e52

    SHA1

    e23fe6e339ad139dd88a18eb962710c638c09d3c

    SHA256

    b6d91e0559c3936090ca8ff2b2b355fb1cd5bea54294d0afbcfd4c16d7a9c833

    SHA512

    9e5a4eaf1c74b685e4c8362e9aa0cb84e903ab53962ec02904e37b9b627c52cd9564c38b4cc5f28e23edce183259336b348b1901206b3350232c1ecf67b85f03

  • memory/2060-0-0x0000000000250000-0x0000000000256000-memory.dmp

    Filesize

    24KB

  • memory/2060-1-0x0000000000290000-0x0000000000296000-memory.dmp

    Filesize

    24KB

  • memory/2060-8-0x0000000000250000-0x0000000000256000-memory.dmp

    Filesize

    24KB

  • memory/3036-15-0x0000000001C90000-0x0000000001C96000-memory.dmp

    Filesize

    24KB

  • memory/3036-17-0x0000000000430000-0x0000000000436000-memory.dmp

    Filesize

    24KB