Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    04/05/2024, 03:40

General

  • Target

    2024-05-04_c6ab5ceafe0f146e240774a5cee153cb_cryptolocker.exe

  • Size

    52KB

  • MD5

    c6ab5ceafe0f146e240774a5cee153cb

  • SHA1

    7a36fcc2c802303f8adc50eaa1e1cd8f1aea3e93

  • SHA256

    23fda4d3d26ed2d8222ac9007c042eba394c3c4a2240a74eea9c28bfecdb8869

  • SHA512

    60cd8c3ac609938e4d1ffff9d3866047fb647129017b50b2a86a2971799dc38e62ad9a9b4953e269cf6c14306b704728a8fa2b8452f6258197965663802636d5

  • SSDEEP

    768:bIDOw9UiaCHfjnE0Sfa7ilR0p9u6p4ICNBCXK9Xv+mb6uYGER:bIDOw9a0DwitDZzc161R

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-04_c6ab5ceafe0f146e240774a5cee153cb_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-04_c6ab5ceafe0f146e240774a5cee153cb_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2108
    • C:\Users\Admin\AppData\Local\Temp\lossy.exe
      "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
      2⤵
      • Executes dropped EXE
      PID:2024

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\lossy.exe

    Filesize

    52KB

    MD5

    39f7b1f0ecce1c9f45f7fcfe3cff521b

    SHA1

    4ef73148054905e81a136dabcbc28c3a9a1eab0f

    SHA256

    eb02b63713e6fca3333d53b8edeb44ec4fc9d9bdde0e39555d84a6bf7e2346fd

    SHA512

    88a524d0e733c0282b8d4dc07f67c3adf4681c846a7e2ae77524536b0015ccdac4ced230b0255628d184f9f3da15163035603a27728c3849a244999a62613be9

  • memory/2024-15-0x0000000000290000-0x0000000000296000-memory.dmp

    Filesize

    24KB

  • memory/2024-22-0x00000000001D0000-0x00000000001D6000-memory.dmp

    Filesize

    24KB

  • memory/2108-0-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2108-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

    Filesize

    24KB

  • memory/2108-8-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB