Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    01/06/2024, 17:47

General

  • Target

    2024-06-01_0d90a7c867594313410030877ff5357d_cryptolocker.exe

  • Size

    69KB

  • MD5

    0d90a7c867594313410030877ff5357d

  • SHA1

    beba6930251e743a5395258a6f666da4a83151a5

  • SHA256

    e2b0754978a0afbb6f9899c253609fc454fb29112e617307f29611ae40fb176e

  • SHA512

    b57d1c17a6a4ac8d8a5492856791a7ede96476a3430db49b5751be14c4cbe8e9b2f2ed7d1157fa7115f4ebb2f6b4793956878265331520086e7fd85ab48a9b1f

  • SSDEEP

    768:XS5nQJ24LR1bytOOtEvwDpjNbZ7uyA36S7MpxRXrZSUNsYD/dA:i5nkFGMOtEvwDpjNbwQEI8UZDW

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • Detection of Cryptolocker Samples 3 IoCs
  • Detects executables built or packed with MPress PE compressor 5 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-01_0d90a7c867594313410030877ff5357d_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-01_0d90a7c867594313410030877ff5357d_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1028
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Executes dropped EXE
      PID:2844

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    69KB

    MD5

    40e4ab965e15179958ce0314474d9d26

    SHA1

    73f52ed61a8190241ab8e01e3680860a6ef194fe

    SHA256

    c0d88da2f58f80be174a6bffe7e666375251bd4c0a3cff693dd661a2a1a12ca6

    SHA512

    f0b4dd85fe0fd93f03911014a2c6a943f939c39c4da17e8c62a56bcb7e0b273cd91627b7232fc5c6eb296fd0a15f95ad585d8553315b232dc7fd4e222d7a2ad4

  • memory/1028-1-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/1028-0-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/1028-2-0x0000000000300000-0x0000000000306000-memory.dmp

    Filesize

    24KB

  • memory/1028-9-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/1028-15-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/2844-17-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/2844-19-0x0000000000290000-0x0000000000296000-memory.dmp

    Filesize

    24KB

  • memory/2844-26-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB