Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    03/06/2024, 06:25

General

  • Target

    2024-06-03_20bc54965e33a62a5a428e9487b29c95_cryptolocker.exe

  • Size

    35KB

  • MD5

    20bc54965e33a62a5a428e9487b29c95

  • SHA1

    facc30b10cf94998c8dde4e735c19dc6902a1fa5

  • SHA256

    00881244eb57ff7f2f80b7b7b18805873f972532d352d291155297b0ec389473

  • SHA512

    b98dc49071b8b88c56b62b69b3e803cb36e6bb511ceb3800a1bdd0fae61880668c1e5ca083f708667e01e91dc3a322b94d8eb9debe33f799163ecc9fc09e92fe

  • SSDEEP

    768:bxNQIE0eBhkL2Fo1CCwgfjOg9Arbkzos5YT:bxNrC7kYo1Fxf2rYo

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-03_20bc54965e33a62a5a428e9487b29c95_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-03_20bc54965e33a62a5a428e9487b29c95_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2056
    • C:\Users\Admin\AppData\Local\Temp\pissa.exe
      "C:\Users\Admin\AppData\Local\Temp\pissa.exe"
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      PID:2704

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\pissa.exe

    Filesize

    35KB

    MD5

    1b148995998eab42c46e3a017c882e20

    SHA1

    a54dbc7ead891f7d64ba1a770fe322dcefe8433f

    SHA256

    d49a6de05fa9d605ef0d923e22418c617de302e23b62c3018678fecbd8f11ddb

    SHA512

    a896365124b07e27f0da6f5bdfc81c177eaae8eb44833ac9620dbea21f621d04074b08af888db19057b307b50067b8a2cb152b6a394e390e9a7cd8d4a8ec6f8f

  • memory/2056-0-0x0000000000700000-0x0000000000706000-memory.dmp

    Filesize

    24KB

  • memory/2056-1-0x0000000000710000-0x0000000000716000-memory.dmp

    Filesize

    24KB

  • memory/2056-8-0x0000000000700000-0x0000000000706000-memory.dmp

    Filesize

    24KB

  • memory/2704-15-0x0000000001CB0000-0x0000000001CB6000-memory.dmp

    Filesize

    24KB

  • memory/2704-22-0x0000000001CA0000-0x0000000001CA6000-memory.dmp

    Filesize

    24KB