Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    03/06/2024, 01:19

General

  • Target

    2024-06-03_a7c85f496655c745446f4d14bf246b13_cryptolocker.exe

  • Size

    74KB

  • MD5

    a7c85f496655c745446f4d14bf246b13

  • SHA1

    75c75e052848e198254eeda2df858df603700ad9

  • SHA256

    bced564c7e51c151b7f085b1245dd1337f24dfd28c7a59279c0270b23ab4ebaf

  • SHA512

    ab45b165599fa40f84df475e6b14ac7f4494ba3fe5c9e9cbdb8cf4081d16fa05987f6cd40941027a5dfc81a0f238841d63f3b8155fd8207d9b31fa665b73699e

  • SSDEEP

    768:u6LsoEEeegiZPvEhHSG+gZgtOOtEvwDpjeY10Y/YMsMYL:u6QFElP6n+gWMOtEvwDpjJGYQb1

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-03_a7c85f496655c745446f4d14bf246b13_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-03_a7c85f496655c745446f4d14bf246b13_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2360
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:2948

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    74KB

    MD5

    b7dc8520efd3bb3140d0287e4baee87b

    SHA1

    3a4b05b6ed0077bf45754e534b952d062ef14d7f

    SHA256

    0543e8b43dd3e3e783d1606d275b07ddb0aecb17c1ed9098c853f8531c6ed0ce

    SHA512

    dc052ae52937e867fe0ed529afa627772d13c8c62e6b9448e96620f61f07467d15952ab14d72274b157657c16ae2d4b38b7a45d0e9909cb33ac251075ad0b740

  • memory/2360-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

    Filesize

    24KB

  • memory/2360-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

    Filesize

    24KB

  • memory/2360-2-0x0000000000310000-0x0000000000316000-memory.dmp

    Filesize

    24KB

  • memory/2948-15-0x00000000004B0000-0x00000000004B6000-memory.dmp

    Filesize

    24KB

  • memory/2948-22-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB