Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    05/05/2024, 08:35

General

  • Target

    2024-05-05_a3073b1436e148d9cb8e336976efb304_cryptolocker.exe

  • Size

    79KB

  • MD5

    a3073b1436e148d9cb8e336976efb304

  • SHA1

    0bf92921d0bfa4a19709f1b4e8661be2ad8f78e6

  • SHA256

    63ed2aaa90a1ed308a83064a3e91340a78feca23d3d971112a68f8041a8d114a

  • SHA512

    e4d68eed4f6ab22439bb1c95917b289a3756931f660ee5f2760b61a569529250ffda97ccc54565df6c4058f5e181c079376e807f67afefe8a4ee8f5737007a5d

  • SSDEEP

    1536:V6QFElP6n+gMQMOtEvwDpjyaLccVNluiCx:V6a+pOtEvwDpjvpq

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-05_a3073b1436e148d9cb8e336976efb304_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-05_a3073b1436e148d9cb8e336976efb304_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2364
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:2112

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    79KB

    MD5

    31a740c7dce309118765df4edfb208a2

    SHA1

    612664b5e9310a4dc24b783529cd0b8297fee4f7

    SHA256

    3b3a544ae185da9b11062e7be8f324de073c2428907a35a79bb6060950be25ba

    SHA512

    2c77df2b62c93bed45c8c2c2198493173332c848824466698208dd37da0035f20f3f020b986f5d1a6b5c83a44c39182369da0a1049027b395fa708bcb389ce05

  • memory/2112-15-0x0000000000380000-0x0000000000386000-memory.dmp

    Filesize

    24KB

  • memory/2364-0-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2364-1-0x0000000000290000-0x0000000000296000-memory.dmp

    Filesize

    24KB

  • memory/2364-8-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB