Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    15/05/2024, 15:21

General

  • Target

    2024-05-15_25bb91962c15d887d9f386d17591143b_cryptolocker.exe

  • Size

    42KB

  • MD5

    25bb91962c15d887d9f386d17591143b

  • SHA1

    68b018e07894376dda83bf34accc393cd919aa5a

  • SHA256

    3fd824d0be3088b39cf060b9fcf8864318ed3ac1da026f65a0c11f94f5591e67

  • SHA512

    e219b8b167977d36e5e025ed27a6c7d41fc493af33e65528d32701a646033a82c2492a4d7268b5c27771fc7b13ac34bc880df2c5e0fdf0cd6a3d9ac0a19214f8

  • SSDEEP

    768:bCDOw9UiaKHfjnD0S16avdrQFiLjJvtAqtB:bCDOw9aMDooc+vAqtB

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-15_25bb91962c15d887d9f386d17591143b_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-15_25bb91962c15d887d9f386d17591143b_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2888
    • C:\Users\Admin\AppData\Local\Temp\lossy.exe
      "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
      2⤵
      • Executes dropped EXE
      PID:3044

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\lossy.exe

    Filesize

    42KB

    MD5

    503d811dca545c56b0dafebe512fd151

    SHA1

    2a4b08cd3502bc08ffa8b21291ce68b72d0fa6f1

    SHA256

    19eed9686969a8010c33ad3e839391819961d52b2eb1b40e81698577c1e63e16

    SHA512

    d6c48acd8475bafbbd5a6f51375978d14b873362e536331778ba4a4fa35b073e1886172ee7126d9f128481dac22c8d09eeb0d3db7bc484d9e4eff07719af464c

  • memory/2888-0-0x0000000008000000-0x000000000800A000-memory.dmp

    Filesize

    40KB

  • memory/2888-1-0x0000000000250000-0x0000000000256000-memory.dmp

    Filesize

    24KB

  • memory/2888-2-0x0000000000310000-0x0000000000316000-memory.dmp

    Filesize

    24KB

  • memory/2888-9-0x0000000000250000-0x0000000000256000-memory.dmp

    Filesize

    24KB

  • memory/2888-15-0x0000000008000000-0x000000000800A000-memory.dmp

    Filesize

    40KB

  • memory/3044-16-0x0000000008000000-0x000000000800A000-memory.dmp

    Filesize

    40KB

  • memory/3044-18-0x00000000002A0000-0x00000000002A6000-memory.dmp

    Filesize

    24KB

  • memory/3044-25-0x00000000001E0000-0x00000000001E6000-memory.dmp

    Filesize

    24KB

  • memory/3044-26-0x0000000008000000-0x000000000800A000-memory.dmp

    Filesize

    40KB