Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    03/06/2024, 12:25

General

  • Target

    2024-06-03_1aa7bd2470a31a521b37e22e93788acd_cryptolocker.exe

  • Size

    54KB

  • MD5

    1aa7bd2470a31a521b37e22e93788acd

  • SHA1

    4d9cf152b4963dedd0fb2d3a47ceece82247d1c1

  • SHA256

    762ea74dff67dfa50870e41fca55a4d88316725f3b73d3106e5f2d3122fd61b4

  • SHA512

    e405e0a39c1b168dd464f0d46a180371a800f8ddda1f90e7d505a5bf97972daef9905aa68255334139798db06efc428cdc520e23bb2dd5cc251c835d1e222ee8

  • SSDEEP

    768:z6LsoEEeegiZPvEhHSG+gzum/kLyMro2GtOOtEvwDpj/YY1J+OTOkgdWz:z6QFElP6n+gKmddpMOtEvwDpj31ikgdQ

Score
9/10
upx

Malware Config

Signatures

  • Detection of CryptoLocker Variants 4 IoCs
  • Detection of Cryptolocker Samples 4 IoCs
  • UPX dump on OEP (original entry point) 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-03_1aa7bd2470a31a521b37e22e93788acd_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-03_1aa7bd2470a31a521b37e22e93788acd_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:3000
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:2556

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    54KB

    MD5

    2cc3a64f0c807f1e952cebb534cde807

    SHA1

    60e73584940d26023835d5b0c69c0ce423735381

    SHA256

    aaa044427155fe966d75e260fb2f70818f5159c1505e4a7358b30d151509a079

    SHA512

    d719d30225bd1f657baba2f545a76e3f985d93218a89d23d20038354f3692e21cacde5975477712bd180df20295ab56e08aae49a4ef11b8998f109bdb42f7c37

  • memory/2556-24-0x00000000004E0000-0x00000000004E6000-memory.dmp

    Filesize

    24KB

  • memory/2556-17-0x0000000000610000-0x0000000000616000-memory.dmp

    Filesize

    24KB

  • memory/2556-25-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/3000-0-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/3000-1-0x0000000000320000-0x0000000000326000-memory.dmp

    Filesize

    24KB

  • memory/3000-9-0x0000000000320000-0x0000000000326000-memory.dmp

    Filesize

    24KB

  • memory/3000-2-0x0000000000460000-0x0000000000466000-memory.dmp

    Filesize

    24KB

  • memory/3000-15-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB