Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    25/05/2024, 04:02

General

  • Target

    2024-05-25_a0ea666dffbe34a24ac302a234d94fca_cryptolocker.exe

  • Size

    35KB

  • MD5

    a0ea666dffbe34a24ac302a234d94fca

  • SHA1

    adb678e89e5349224ac2f89b5e60636ff555c966

  • SHA256

    54cd04bb370bb8f2aa0281e1f4efa885773dde34a761df03496e815b8e2993da

  • SHA512

    43aee9a4edba3caca5d31cce7cb12c035b1c0a076d6c5f5377bfa15171943ab05337bf777c37c0568be2dbaca86d9853cf09f2186cb76dd2f06cbc73a63e7a80

  • SSDEEP

    384:bAvMaNGh4z7CG3POOvbRSLoF/F0QU5XYFnufc/zzo6ckJp0qAgmEzXKxA+T9riu:bAvJCYOOvbRPDEgXRc+BAILiJiu

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-25_a0ea666dffbe34a24ac302a234d94fca_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-25_a0ea666dffbe34a24ac302a234d94fca_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2700
    • C:\Users\Admin\AppData\Local\Temp\demka.exe
      "C:\Users\Admin\AppData\Local\Temp\demka.exe"
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:2580

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\demka.exe

    Filesize

    35KB

    MD5

    f6150dbf80361fb67d2a592393d3c5c6

    SHA1

    9e25b9948112813b8071d76b9ab6049af05ac658

    SHA256

    6e3c151fda886998c6a7b807744fff71613b38620720820c8f300a4c8709676f

    SHA512

    1dd71e9a39d56235e0470b50e9aaefb0451f6cd40d16779c17b3ebb33a9dc4c46aadec982ef12436c0e88ed216a2917e33966d51ef434e2f0b8f6ba3e5aeaf7e

  • memory/2580-23-0x0000000000300000-0x0000000000306000-memory.dmp

    Filesize

    24KB

  • memory/2700-0-0x0000000000360000-0x0000000000366000-memory.dmp

    Filesize

    24KB

  • memory/2700-1-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/2700-8-0x0000000000360000-0x0000000000366000-memory.dmp

    Filesize

    24KB