Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    30/04/2024, 18:24

General

  • Target

    2024-04-30_f5b8490492a06008dfa3ecc6ddf844a2_cryptolocker.exe

  • Size

    41KB

  • MD5

    f5b8490492a06008dfa3ecc6ddf844a2

  • SHA1

    3fc4a141a6ebea7a740e4adbd704183e91e35c5c

  • SHA256

    e0e5253294f632251f5e53ca5fe22e17ab8e9b5f465f72012da1997a55f57213

  • SHA512

    4ef0fabfdbdd07ebd79eeca7d9bd62242c2c5995c369d4b1af6c7e7998cc87d1de9266b585e349bbfb49139d2d6b99cd8f8d875d083d7a2a9fcb14b6e0b910d0

  • SSDEEP

    768:bIDOw9UiaCHfjnE0Sf88AvvP1oghYvm9/6DyE9xgyu:bIDOw9a0Dwo3P1ojvUSD79yyu

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-30_f5b8490492a06008dfa3ecc6ddf844a2_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-30_f5b8490492a06008dfa3ecc6ddf844a2_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:3008
    • C:\Users\Admin\AppData\Local\Temp\lossy.exe
      "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
      2⤵
      • Executes dropped EXE
      PID:2848

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\lossy.exe

    Filesize

    41KB

    MD5

    cf2f5084dc4d75b713448cb167b21f3f

    SHA1

    c05a8012e5a6e974ea026adf76368595f7584d03

    SHA256

    240fd70bd3704243fc0b1739b4112f03cdd1c9d445c66b9b0dfe02daa707d1dd

    SHA512

    d1af07981e7a66b56d53277473fe96e0fb1d82741b2ec51a4af5c7429e46593b051717d3d5e020f17f5d782c25d96d599d5497d3acc94eceb53ad586e20d1ccd

  • memory/2848-15-0x0000000000280000-0x0000000000286000-memory.dmp

    Filesize

    24KB

  • memory/2848-22-0x0000000000230000-0x0000000000236000-memory.dmp

    Filesize

    24KB

  • memory/3008-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

    Filesize

    24KB

  • memory/3008-8-0x00000000001D0000-0x00000000001D6000-memory.dmp

    Filesize

    24KB

  • memory/3008-1-0x0000000000210000-0x0000000000216000-memory.dmp

    Filesize

    24KB