Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    24/04/2024, 22:30

General

  • Target

    2024-04-24_9973f8c2bcc0768b96f3ba05d2e3adb8_cryptolocker.exe

  • Size

    36KB

  • MD5

    9973f8c2bcc0768b96f3ba05d2e3adb8

  • SHA1

    4f090606cb5f909c4a71d38e436ebc8aadb6d593

  • SHA256

    3b9193480a544e5b7ff72ba9a0cd92d0781324f422a94212ec9c109d5f9c41b0

  • SHA512

    cde1956c41f052171b766f99dcc8568ef0114d0abe7f7af87e81c91dd52aebd90befe37911622f8490b3b76247e9e462c9ec70dff1deeee6b4de6f2db9417249

  • SSDEEP

    768:fTz7y3lhsT+hs1SQtOOtEvwDpjfAu9+4/W:fT+hsMQMOtEvwDpjoIHe

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-24_9973f8c2bcc0768b96f3ba05d2e3adb8_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-24_9973f8c2bcc0768b96f3ba05d2e3adb8_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2944
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Executes dropped EXE
      PID:2356

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    36KB

    MD5

    8a952aa1036d1c9d88ace00473727a31

    SHA1

    354dd5474528984c554111c6c845f947ba67c76f

    SHA256

    db4cc972c447ff1b06d5330d9c84bd9d97db4502ac4f7305f204dcc6f6a6c1ec

    SHA512

    71e8c909bf27b00438027bd854e3a53b5c0b4d3baa4b54ae9c061dab508821b54ca731d339b27e3246f18ccd9f2ffe4702f06035437e5ab24d3b419424279d30

  • memory/2356-15-0x0000000000490000-0x0000000000496000-memory.dmp

    Filesize

    24KB

  • memory/2356-16-0x0000000000440000-0x0000000000446000-memory.dmp

    Filesize

    24KB

  • memory/2944-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

    Filesize

    24KB

  • memory/2944-1-0x00000000001D0000-0x00000000001D6000-memory.dmp

    Filesize

    24KB

  • memory/2944-2-0x0000000000290000-0x0000000000296000-memory.dmp

    Filesize

    24KB