Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    26/04/2024, 19:42

General

  • Target

    2024-04-26_ee92db100930e20ab11921d51fe1f637_cryptolocker.exe

  • Size

    43KB

  • MD5

    ee92db100930e20ab11921d51fe1f637

  • SHA1

    e034e72bf3f15205a3776db30f53330494477654

  • SHA256

    cd3fa6f968151f345361d2276dd2664458d4d8a9aace0cdbd31df0dee1006beb

  • SHA512

    3cc47bfae9f44224838d566ba2d8175b6cc2fa943deaf0390aca5b24b49c11d187716df64b296df23c52096ead66c7efef90d716363b04fbd6ae3f2f6569963e

  • SSDEEP

    768:Kf1K2exg2kBwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZsBGGpebVIYLHA3KxI:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XJ

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-26_ee92db100930e20ab11921d51fe1f637_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-26_ee92db100930e20ab11921d51fe1f637_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2336
    • C:\Users\Admin\AppData\Local\Temp\hurok.exe
      "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2184

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\hurok.exe

    Filesize

    44KB

    MD5

    57833f3cd90d750bcfea954c826cfc96

    SHA1

    12d8528caf6e600693a8c825f21868910b78a06a

    SHA256

    44f9e6e41983d1bcfa839fd7c619ca7366160f818b0af120d4bcdd226c5532d1

    SHA512

    b9c7b1293bf75e7949c104d2722e71ac6de4f81386ba852f382aa63ad0644f512f73736559865df1bea2cc7ba470b72c11d78c20dc9f1130c4a76716fd2bce6c

  • memory/2336-0-0x00000000002B0000-0x00000000002B6000-memory.dmp

    Filesize

    24KB

  • memory/2336-2-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/2336-1-0x00000000002B0000-0x00000000002B6000-memory.dmp

    Filesize

    24KB