Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    31/05/2024, 17:04

General

  • Target

    2024-05-31_03d29f2b5b747296ed57d7ccea57495f_cryptolocker.exe

  • Size

    38KB

  • MD5

    03d29f2b5b747296ed57d7ccea57495f

  • SHA1

    e44a23b9995e2a675e47c58dc21857c8def04761

  • SHA256

    60f5244787828a82c59b0dec628971c311546d5354a2a0bbc25077961e9042a1

  • SHA512

    43860640b82efb4a43323f16e9352f4b9091521dc50bdca2fdd8cd0dca5364e7f0fbf9ec15cac09149ea4f3d99329e54cc28d82b8414a02b6b85b82d39d0ed0b

  • SSDEEP

    768:fTz7y3lhsT+hs1SQtOOtEvwDpjfAu9+4Hz:fT+hsMQMOtEvwDpjoIHT

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-31_03d29f2b5b747296ed57d7ccea57495f_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-31_03d29f2b5b747296ed57d7ccea57495f_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2364
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Executes dropped EXE
      PID:2400

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    39KB

    MD5

    3efce5e66ee18dc5ddc3e1c899eed3b8

    SHA1

    8be992389c8c8346c0065937bf775bf5ee3e0d48

    SHA256

    1ba40045d0caba55a952c7f51f964d3b89923c6c83abd08d25a9772857a39c52

    SHA512

    b00b1012b31b2934839d8995e0f6ba8cd586fbb66553f6f371a0166cd63583e488104110832136f02695ca4e3d66daeabedbd77bf8e49064f3cf640d6309ab52

  • memory/2364-0-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2364-1-0x0000000000280000-0x0000000000286000-memory.dmp

    Filesize

    24KB

  • memory/2364-8-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2400-15-0x0000000000390000-0x0000000000396000-memory.dmp

    Filesize

    24KB

  • memory/2400-22-0x00000000002C0000-0x00000000002C6000-memory.dmp

    Filesize

    24KB