Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    15/05/2024, 18:27

General

  • Target

    2024-05-15_1a4575d7756ef7efbcadc7e5bb6088c2_cryptolocker.exe

  • Size

    41KB

  • MD5

    1a4575d7756ef7efbcadc7e5bb6088c2

  • SHA1

    7b696471223ff75972fa48232b7737592d697f3e

  • SHA256

    bcbd9be946286d03ae2ef96d93d58a1c87d3bab3170e273c959a375491718459

  • SHA512

    a91d0c1e126c6a7edc3fd29138188cd5fafcd35f51685022256cee4b825758289e8aa4c0b548001d5072c725427bde5027efa3d1cc62ba4874c4b7fec123154a

  • SSDEEP

    768:bCDOw9UiaKHfjnD0S16avdrQFiLjJvtAqtA:bCDOw9aMDooc+vAqtA

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-15_1a4575d7756ef7efbcadc7e5bb6088c2_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-15_1a4575d7756ef7efbcadc7e5bb6088c2_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2308
    • C:\Users\Admin\AppData\Local\Temp\lossy.exe
      "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
      2⤵
      • Executes dropped EXE
      PID:2664

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\lossy.exe

    Filesize

    42KB

    MD5

    e329dacb7c9adc4841649a5050395a2f

    SHA1

    22871d12467bd00713314db58b9d23e422d3bb93

    SHA256

    6b4cd8965344937ed35e50f858db2a64f29551c06801aa14365750ac02a40c9f

    SHA512

    30954c586daa7390e7eca522bdc72287a4232051869985ee019b465cbc060544367b8aeb1e4d726fa9e83de6b7cc79975dbc56efa4fb6141547dd126c1f62021

  • memory/2308-0-0x0000000008000000-0x000000000800A000-memory.dmp

    Filesize

    40KB

  • memory/2308-1-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2308-2-0x0000000000280000-0x0000000000286000-memory.dmp

    Filesize

    24KB

  • memory/2308-8-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2308-16-0x0000000008000000-0x000000000800A000-memory.dmp

    Filesize

    40KB

  • memory/2308-14-0x0000000002210000-0x000000000221A000-memory.dmp

    Filesize

    40KB

  • memory/2664-26-0x0000000008000000-0x000000000800A000-memory.dmp

    Filesize

    40KB

  • memory/2664-25-0x00000000001D0000-0x00000000001D6000-memory.dmp

    Filesize

    24KB

  • memory/2664-18-0x00000000002A0000-0x00000000002A6000-memory.dmp

    Filesize

    24KB