Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    11/05/2024, 12:30

General

  • Target

    2024-05-11_cdeca6234d9ea668c9fdc2b936782afb_cryptolocker.exe

  • Size

    39KB

  • MD5

    cdeca6234d9ea668c9fdc2b936782afb

  • SHA1

    25363aa8fc19b8f9969de8c47807276b68be7e9b

  • SHA256

    876d430838801ab597b26249a1b5f81d8409205b9282cf590caa514f75e22b36

  • SHA512

    b8f462cd95054352046b9d27998d23e7a4d680034819de5506f279a1ded0f6882d5f9f579695deebe85c8d3a9708cbc6a350bb30f5db62b11ea91862ce2572b5

  • SSDEEP

    768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITY9V:qDdFJy3QMOtEvwDpjjWMl7TO

Score
9/10
upx

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • Detection of Cryptolocker Samples 5 IoCs
  • UPX dump on OEP (original entry point) 5 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-11_cdeca6234d9ea668c9fdc2b936782afb_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-11_cdeca6234d9ea668c9fdc2b936782afb_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2324
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:1308

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    39KB

    MD5

    a1043256478c7b92f5ce35031ebfb906

    SHA1

    fa8c64221d208538ea1aa95cbf176dc45a5180c8

    SHA256

    182a618d7bf92814c3f10c73400451ae89b3929e7bd28596f28b324fd8208393

    SHA512

    826e2991edaa2fc99e8e23165cda209ca1f0deebe2e00e8efd605741b88d6d6877e2c48b060f6801c36277a0a7bc0717c98981f8e263426388b0a57413c78738

  • memory/1308-26-0x00000000002B0000-0x00000000002B6000-memory.dmp

    Filesize

    24KB

  • memory/1308-19-0x0000000000300000-0x0000000000306000-memory.dmp

    Filesize

    24KB

  • memory/1308-27-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2324-0-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2324-3-0x0000000000280000-0x0000000000286000-memory.dmp

    Filesize

    24KB

  • memory/2324-2-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2324-1-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2324-16-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2324-13-0x0000000001DA0000-0x0000000001DB0000-memory.dmp

    Filesize

    64KB