Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    23/05/2024, 22:29

General

  • Target

    2024-05-23_71f5e9d05c9638b868d40b17f4398572_cryptolocker.exe

  • Size

    44KB

  • MD5

    71f5e9d05c9638b868d40b17f4398572

  • SHA1

    2d469ada739f322742994f27cd809a87b2598047

  • SHA256

    42e81b518558a61270452941ef5dc2815e0bde76111125137a306399a8352172

  • SHA512

    e8d01967e7e6757737c933d233f0286f1f9f67714b6cd1b1ae5f3fccd727df465f0e1dfac0faf42ab438349f640bbe7adf4edee7e618a905ac50f4b7ec330f9f

  • SSDEEP

    768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4REL+cc66TcN:vj+jsMQMOtEvwDpj5HW5scN

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-23_71f5e9d05c9638b868d40b17f4398572_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-23_71f5e9d05c9638b868d40b17f4398572_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1712
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Executes dropped EXE
      PID:1860

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    44KB

    MD5

    349c8f239628f4c8d6df2f52dbeacd3a

    SHA1

    1e02044710dab6792bd9d0dcf82d0cdbba5475c5

    SHA256

    32cf55f0a2235dd5f3e43685459c57bc4d5efa6b04438cc2eb29d7f978a33b5c

    SHA512

    84407a7129ec4b10a065a2b2f212958b433befe026fe949f5d730ab0b8068746b1771c8c1ae828b2f40747f68cd9521243e3eab68f74ad9dff36c2b2b63bcfbf

  • memory/1712-0-0x00000000003C0000-0x00000000003C6000-memory.dmp

    Filesize

    24KB

  • memory/1712-1-0x00000000004D0000-0x00000000004D6000-memory.dmp

    Filesize

    24KB

  • memory/1712-8-0x00000000003C0000-0x00000000003C6000-memory.dmp

    Filesize

    24KB

  • memory/1860-22-0x00000000002C0000-0x00000000002C6000-memory.dmp

    Filesize

    24KB

  • memory/1860-15-0x0000000000310000-0x0000000000316000-memory.dmp

    Filesize

    24KB