Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    02/05/2024, 02:26

General

  • Target

    2024-05-02_39c684f4f09f512f4fa3efb9e223238b_cryptolocker.exe

  • Size

    44KB

  • MD5

    39c684f4f09f512f4fa3efb9e223238b

  • SHA1

    dd5d30076022acff1ce1ecc0771b49ad7ca470dc

  • SHA256

    743b95391604ece4eb58acbce54432d159272149457493e53e351cedeadc358d

  • SHA512

    60c9f75c19c6b269e0d35d686e3a4f5832aa1d99eb7bbdccdc167a2397daac3bed0fa8e55ce15523f0d0ec2f98bff06ece5eac5e0716c563d0f88cf1e267198b

  • SSDEEP

    768:Kf1K2exg2kBwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZsBGGpebVIYLHA3KxK:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XX

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-02_39c684f4f09f512f4fa3efb9e223238b_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-02_39c684f4f09f512f4fa3efb9e223238b_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2220
    • C:\Users\Admin\AppData\Local\Temp\hurok.exe
      "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2832

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\hurok.exe

    Filesize

    44KB

    MD5

    b0bd50430677b1df48ea927ddd617f92

    SHA1

    aaf598715067357cd130353804cd4e8f999c3a9c

    SHA256

    75a6f4717a682d4bc9ad07d28f862b03043b896eff23b25a382ac14c66b9ef56

    SHA512

    a17429ccc7993e74d6b4a3454f8bc9eb5b065ec8409a8bb048a07c944a742c532d3c24f8e8990f1ef47778b425abf955077c492ea5781b34b45b1480f43a069e

  • memory/2220-0-0x00000000001C0000-0x00000000001C6000-memory.dmp

    Filesize

    24KB

  • memory/2220-1-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/2220-8-0x00000000001C0000-0x00000000001C6000-memory.dmp

    Filesize

    24KB

  • memory/2832-23-0x00000000003B0000-0x00000000003B6000-memory.dmp

    Filesize

    24KB