Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    159s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    21/05/2024, 19:31

General

  • Target

    2024-05-21_7b240d331840a2039a2c7d1affcca173_cryptolocker.exe

  • Size

    43KB

  • MD5

    7b240d331840a2039a2c7d1affcca173

  • SHA1

    a86ee489b222a41cf6c0262503a77365b95af5b0

  • SHA256

    9f1f518d99125fdb0734c9bf9823c74e8242bcbf0b4166e11480de06a897d7e9

  • SHA512

    efd69f1beb5bb21606b1b4c97fb2702fa31c33ef7805edb83f4dba33dc09403a4c8e7022d01b302a9cea88bf18c026e1e0c1cd1001809e23716b57db4b93d1fd

  • SSDEEP

    768:bCDOw9UiaKHfjnD0S16avdrQFiLjJvtAH+:bCDOw9aMDooc+vAe

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-21_7b240d331840a2039a2c7d1affcca173_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-21_7b240d331840a2039a2c7d1affcca173_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2180
    • C:\Users\Admin\AppData\Local\Temp\lossy.exe
      "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
      2⤵
      • Executes dropped EXE
      PID:2504

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\lossy.exe

    Filesize

    43KB

    MD5

    f8a484ec8b7730b97d5f661b8468a045

    SHA1

    400453079fde07bc23ecfb80b2307e4fd282f434

    SHA256

    7b6f632ef0741237359033221c2a14a6f2621cdc2086d4a3e8f7b906899f9016

    SHA512

    4ca5f8a4897e545a5b088a1dd8b67ceb97d74047aa64a36753de316c1e8e12ae483eb42d7871f0863ee3445472ff4f1f5e85c5c5bc4e3b63c5892d21cc60ebf5

  • memory/2180-0-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2180-1-0x0000000008000000-0x000000000800A000-memory.dmp

    Filesize

    40KB

  • memory/2180-2-0x0000000000360000-0x0000000000366000-memory.dmp

    Filesize

    24KB

  • memory/2180-9-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2180-14-0x0000000008000000-0x000000000800A000-memory.dmp

    Filesize

    40KB

  • memory/2504-16-0x0000000008000000-0x000000000800A000-memory.dmp

    Filesize

    40KB

  • memory/2504-18-0x00000000001D0000-0x00000000001D6000-memory.dmp

    Filesize

    24KB

  • memory/2504-19-0x0000000000200000-0x0000000000206000-memory.dmp

    Filesize

    24KB

  • memory/2504-26-0x0000000008000000-0x000000000800A000-memory.dmp

    Filesize

    40KB