Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    31/05/2024, 23:33 UTC

General

  • Target

    2024-05-31_7cb318f9d4b86cf44be7ecadf528d3ea_cryptolocker.exe

  • Size

    39KB

  • MD5

    7cb318f9d4b86cf44be7ecadf528d3ea

  • SHA1

    6e13ded0b67e8d215b85a9405bf2e33598e83301

  • SHA256

    de2785df4b535d61b8ad23bc1b46c235619ecfc7880f31963d6aa49877381de6

  • SHA512

    68aeb140434289a6f85792cab40dd37e79a9db8422c6dcc51fb37604ecd5cb6fac142a18055fd0b69e926bd549ca80603b33f8c8c0c7492751fb89baeb147bef

  • SSDEEP

    768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITY7f:qDdFJy3QMOtEvwDpjjWMl7Tsf

Score
9/10
upx

Malware Config

Signatures

  • Detection of CryptoLocker Variants 4 IoCs
  • Detection of Cryptolocker Samples 4 IoCs
  • UPX dump on OEP (original entry point) 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-31_7cb318f9d4b86cf44be7ecadf528d3ea_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-31_7cb318f9d4b86cf44be7ecadf528d3ea_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2364
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:2576

Network

  • flag-us
    DNS
    emrlogistics.com
    asih.exe
    Remote address:
    8.8.8.8:53
    Request
    emrlogistics.com
    IN A
    Response
    emrlogistics.com
    IN CNAME
    traff-3.hugedomains.com
    traff-3.hugedomains.com
    IN CNAME
    hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com
    hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com
    IN A
    3.19.116.195
    hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com
    IN A
    3.18.7.81
  • flag-us
    DNS
    emrlogistics.com
    asih.exe
    Remote address:
    8.8.8.8:53
    Request
    emrlogistics.com
    IN A
  • flag-us
    DNS
    emrlogistics.com
    asih.exe
    Remote address:
    8.8.8.8:53
    Request
    emrlogistics.com
    IN A
  • flag-us
    DNS
    emrlogistics.com
    asih.exe
    Remote address:
    8.8.8.8:53
    Request
    emrlogistics.com
    IN A
  • 3.19.116.195:443
    emrlogistics.com
    asih.exe
    152 B
    3
  • 3.18.7.81:443
    emrlogistics.com
    asih.exe
    152 B
    3
  • 3.19.116.195:443
    emrlogistics.com
    asih.exe
    152 B
    3
  • 3.18.7.81:443
    emrlogistics.com
    asih.exe
    152 B
    3
  • 3.19.116.195:443
    emrlogistics.com
    asih.exe
    152 B
    3
  • 3.18.7.81:443
    emrlogistics.com
    asih.exe
    152 B
    3
  • 3.19.116.195:443
    emrlogistics.com
    asih.exe
    152 B
    3
  • 8.8.8.8:53
    emrlogistics.com
    dns
    asih.exe
    248 B
    192 B
    4
    1

    DNS Request

    emrlogistics.com

    DNS Request

    emrlogistics.com

    DNS Request

    emrlogistics.com

    DNS Request

    emrlogistics.com

    DNS Response

    3.19.116.195
    3.18.7.81

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    39KB

    MD5

    c849ab0cb4e8e10ff689fce6d2d86399

    SHA1

    ae2bcb8afb65dfb3deff220b9384192d7aa1f6b0

    SHA256

    648b4a520ecc9e4eab8b18eae81c56ee0415e1dcbfa85b00da4a40a1b66c6b84

    SHA512

    939ef57850a1fc8e0e5926cc48309f19a27302ba747adcd744aa8d8d61196781c1bcd851436bce5d1bbf7f084ee880fe34ee8c692c8e52d92e74dda989a55518

  • memory/2364-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

    Filesize

    24KB

  • memory/2364-1-0x00000000004E0000-0x00000000004E6000-memory.dmp

    Filesize

    24KB

  • memory/2364-9-0x00000000001D0000-0x00000000001D6000-memory.dmp

    Filesize

    24KB

  • memory/2364-8-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2576-16-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2576-18-0x0000000000290000-0x0000000000296000-memory.dmp

    Filesize

    24KB

  • memory/2576-25-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.