Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    05/06/2024, 22:22

General

  • Target

    2024-06-05_543464aa8a0a6053a963586836da668e_cryptolocker.exe

  • Size

    40KB

  • MD5

    543464aa8a0a6053a963586836da668e

  • SHA1

    dcfd97b667bf7f97257f26bf47a1fd9f140ba79d

  • SHA256

    a891c9d79bcc0ee1399d9b2dc7e94c3acd7cda16440884f2cb82d1a668e49e08

  • SHA512

    6363200ba4cab21913d929f0776fa4069f337280f50c956913f042ffe359dedd052e50f729cecfc321287a3a608da90b83f751916cf53afbe437eb5ec11c9225

  • SSDEEP

    768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYan8R:qDdFJy3QMOtEvwDpjjWMl7Tdn8R

Score
9/10
upx

Malware Config

Signatures

  • Detection of CryptoLocker Variants 4 IoCs
  • Detection of Cryptolocker Samples 4 IoCs
  • UPX dump on OEP (original entry point) 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-05_543464aa8a0a6053a963586836da668e_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-05_543464aa8a0a6053a963586836da668e_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2108
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:2796

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    40KB

    MD5

    c708e4254cbb785f8b2b5396194252eb

    SHA1

    9fd7a62bf3f35089588703f47b9668644bd52358

    SHA256

    3d3a5e08bcb9783c29c0ca9447bafe30d19cdabbb757e4eee5242242f5e8ed20

    SHA512

    6971b0b7e34d08e0a46857053068692481c8ffe5b811bb5f7573f8851d6d556106b42d30e250badbec1b2b6161630728a5eb82bb0ee4e31ce6ff37521ea7e0f8

  • memory/2108-0-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2108-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

    Filesize

    24KB

  • memory/2108-9-0x00000000002C0000-0x00000000002C6000-memory.dmp

    Filesize

    24KB

  • memory/2108-2-0x0000000000470000-0x0000000000476000-memory.dmp

    Filesize

    24KB

  • memory/2108-16-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2796-25-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2796-18-0x0000000000380000-0x0000000000386000-memory.dmp

    Filesize

    24KB

  • memory/2796-26-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB