Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
31/05/2024, 23:33 UTC
General
-
Target
2024-05-31_7cb318f9d4b86cf44be7ecadf528d3ea_cryptolocker.exe
-
Size
39KB
-
MD5
7cb318f9d4b86cf44be7ecadf528d3ea
-
SHA1
6e13ded0b67e8d215b85a9405bf2e33598e83301
-
SHA256
de2785df4b535d61b8ad23bc1b46c235619ecfc7880f31963d6aa49877381de6
-
SHA512
68aeb140434289a6f85792cab40dd37e79a9db8422c6dcc51fb37604ecd5cb6fac142a18055fd0b69e926bd549ca80603b33f8c8c0c7492751fb89baeb147bef
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITY7f:qDdFJy3QMOtEvwDpjjWMl7Tsf
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-31_7cb318f9d4b86cf44be7ecadf528d3ea_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-31_7cb318f9d4b86cf44be7ecadf528d3ea_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
-
DNSemrlogistics.comRemote address:8.8.8.8:53Requestemrlogistics.comIN AResponseemrlogistics.comIN CNAMEtraff-3.hugedomains.comtraff-3.hugedomains.comIN CNAMEhdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.comhdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.comIN A3.19.116.195hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.comIN A3.18.7.81 -
DNSemrlogistics.comRemote address:8.8.8.8:53Requestemrlogistics.comIN A
-
DNSemrlogistics.comRemote address:8.8.8.8:53Requestemrlogistics.comIN A
-
DNSemrlogistics.comRemote address:8.8.8.8:53Requestemrlogistics.comIN A
-
3.19.116.195:443emrlogistics.com
-
3.18.7.81:443emrlogistics.com
-
3.19.116.195:443emrlogistics.com
-
3.18.7.81:443emrlogistics.com
-
3.19.116.195:443emrlogistics.com
-
3.18.7.81:443emrlogistics.com
-
3.19.116.195:443emrlogistics.com
-
8.8.8.8:53emrlogistics.comdns
DNS Request
emrlogistics.com
DNS Request
emrlogistics.com
DNS Request
emrlogistics.com
DNS Request
emrlogistics.com
DNS Response
3.19.116.1953.18.7.81
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD5c849ab0cb4e8e10ff689fce6d2d86399
SHA1ae2bcb8afb65dfb3deff220b9384192d7aa1f6b0
SHA256648b4a520ecc9e4eab8b18eae81c56ee0415e1dcbfa85b00da4a40a1b66c6b84
SHA512939ef57850a1fc8e0e5926cc48309f19a27302ba747adcd744aa8d8d61196781c1bcd851436bce5d1bbf7f084ee880fe34ee8c692c8e52d92e74dda989a55518
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB