Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    27/05/2024, 19:52

General

  • Target

    2024-05-27_eb17d7fa5fd9855ea8ea6b88f77ba142_cryptolocker.exe

  • Size

    24KB

  • MD5

    eb17d7fa5fd9855ea8ea6b88f77ba142

  • SHA1

    ec3692e1434fcb3bce20e2a6e75285242f1e3d49

  • SHA256

    a11b933a7cccdc924d7b02b06d9b450fc98e636006adfb36fb57da25cba2a024

  • SHA512

    0d1827d1c47019f971ed390b2539cadd25ff011244dcd20ff33058ae9b575324b1c37aa18d08140060b4d7a91d4c8c76eb5f2e0bc6952124e31af267ea21fd3a

  • SSDEEP

    384:bVCPwFRuFn65arz1ZhdaXFXSCVQTLfjDp6HMJ2Y:bVCPwFRo6CpwXFXSqQXfjAsJb

Score
9/10
upx

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • UPX dump on OEP (original entry point) 5 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-27_eb17d7fa5fd9855ea8ea6b88f77ba142_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-27_eb17d7fa5fd9855ea8ea6b88f77ba142_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2372
    • C:\Users\Admin\AppData\Local\Temp\hasfj.exe
      "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
      2⤵
      • Executes dropped EXE
      PID:3020

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\hasfj.exe

    Filesize

    24KB

    MD5

    0d426d7daff290d9e5b6994e56502e5f

    SHA1

    843619ec1474e584a6bab49b6d9a33a1ca8d45dd

    SHA256

    e63cd605027bf430837b96f498f87a2a5b7a28d538dd43124fa48f9429b08605

    SHA512

    b4e2ec25bfe17c4f3a68dad8e6863f3dc6bfcd690d43bbc9272962de5e49f207a3894da51865fd02cf53fc4b3be73d08c15100c3501ab857eeafee3e0ebe271b

  • memory/2372-0-0x0000000008000000-0x000000000800E000-memory.dmp

    Filesize

    56KB

  • memory/2372-1-0x00000000002A0000-0x00000000002A6000-memory.dmp

    Filesize

    24KB

  • memory/2372-9-0x00000000002A0000-0x00000000002A6000-memory.dmp

    Filesize

    24KB

  • memory/2372-2-0x0000000000370000-0x0000000000376000-memory.dmp

    Filesize

    24KB

  • memory/2372-15-0x0000000008000000-0x000000000800E000-memory.dmp

    Filesize

    56KB

  • memory/3020-17-0x0000000008000000-0x000000000800E000-memory.dmp

    Filesize

    56KB

  • memory/3020-19-0x0000000000580000-0x0000000000586000-memory.dmp

    Filesize

    24KB

  • memory/3020-26-0x0000000000570000-0x0000000000576000-memory.dmp

    Filesize

    24KB

  • memory/3020-27-0x0000000008000000-0x000000000800E000-memory.dmp

    Filesize

    56KB