Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    15/05/2024, 23:51

General

  • Target

    2024-05-15_713b5871aa90940f2347218bfeeb8281_cryptolocker.exe

  • Size

    86KB

  • MD5

    713b5871aa90940f2347218bfeeb8281

  • SHA1

    476004edead7228d1e9458abebd583f7af695cbf

  • SHA256

    c275fc2f756e9ac2a34820e18b8ce0c72a9984e027e797101b78cb07c842ade3

  • SHA512

    41c92003c752ca6e17961c1054c26f6315fb9e706edea898cb3fcd4abeaa0651fd07cf841cdeabc714a3c40fde85fc40780aacf556197e0407aca4829c2ffb55

  • SSDEEP

    1536:vj+jsMQMOtEvwDpj5HwYYTjipvF2hBfWafHNBlX:vCjsIOtEvwDpj5H9YvQd2l

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-15_713b5871aa90940f2347218bfeeb8281_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-15_713b5871aa90940f2347218bfeeb8281_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:3060
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Executes dropped EXE
      PID:2852

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    86KB

    MD5

    1740d4e472411760655029569dddb021

    SHA1

    18945b14733e0de33e91f1d74c7b0bd0b56f8585

    SHA256

    812a35cbb003282d858e2dc6ee6f3a72fb136ef48a795e72a36112526d395d82

    SHA512

    79d4e48d8cde4bc845e3ee5bbb0d5c66f8089046e3f85a482c81f6398e7b5ccb26654623d3ebb9413a686add27368040a8ff5537ac50ae7e22f4dd28bbc2e83b

  • memory/2852-22-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2852-15-0x0000000000480000-0x0000000000486000-memory.dmp

    Filesize

    24KB

  • memory/3060-0-0x0000000000250000-0x0000000000256000-memory.dmp

    Filesize

    24KB

  • memory/3060-1-0x0000000000290000-0x0000000000296000-memory.dmp

    Filesize

    24KB

  • memory/3060-8-0x0000000000250000-0x0000000000256000-memory.dmp

    Filesize

    24KB