Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    12/05/2024, 03:32

General

  • Target

    2024-05-12_154dfc2a8b080efa2325450db484684f_cryptolocker.exe

  • Size

    90KB

  • MD5

    154dfc2a8b080efa2325450db484684f

  • SHA1

    474d7f2fb9fbf9b86681c7b7697f9e2d88e7290e

  • SHA256

    9922a3809ad2c481544186dd15b1cca8522884bafca885fc25e73a7d2cd0c5c2

  • SHA512

    04872ce5ad3f09731770fb9009b718faf40115103b4657708bc9a59e684a1a94ef25408a092873e8d899b13c35f97eef224e9b7a2836a2cdaac32405602d1d21

  • SSDEEP

    1536:n6QFElP6n+g9u9cvMOtEvwDpjYYTjipvF2bx1PQAA/U:n6a+1SEOtEvwDpjYYvQd2PT

Score
9/10
upx

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • Detection of Cryptolocker Samples 5 IoCs
  • UPX dump on OEP (original entry point) 5 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-12_154dfc2a8b080efa2325450db484684f_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-12_154dfc2a8b080efa2325450db484684f_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2756
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:1704

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    90KB

    MD5

    27c718403b15e23fea89e8d3ea3231de

    SHA1

    381d09f546159e178d43891c8cb8b2c2aa398ef4

    SHA256

    6c15b347a3af728114e13f33ef228de6d7d1d7482d9a9f73e5ed2c71213787b0

    SHA512

    2e27fb66e81f15cf26132647231e70a620ee7d6751c54e2fcdc9b4350747cb858e65bfb795e556ea4b6405e68aa9426d822135911298b48c122c9b4e84deca2d

  • memory/1704-16-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/1704-18-0x00000000004B0000-0x00000000004B6000-memory.dmp

    Filesize

    24KB

  • memory/1704-25-0x0000000000300000-0x0000000000306000-memory.dmp

    Filesize

    24KB

  • memory/1704-26-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2756-0-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2756-1-0x0000000000320000-0x0000000000326000-memory.dmp

    Filesize

    24KB

  • memory/2756-3-0x0000000000460000-0x0000000000466000-memory.dmp

    Filesize

    24KB

  • memory/2756-2-0x0000000000320000-0x0000000000326000-memory.dmp

    Filesize

    24KB

  • memory/2756-15-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB