Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    09/06/2024, 22:45

General

  • Target

    2024-06-09_f6f58455eb1c2715be8f60fef0665df9_cryptolocker.exe

  • Size

    43KB

  • MD5

    f6f58455eb1c2715be8f60fef0665df9

  • SHA1

    168c06b158b5aeaa1bbfa63e80cab9bdfdc732a4

  • SHA256

    16721ba2f45dd8dc9f8482b1a362008846cb8865fa58551f1c28e1ec11ab092c

  • SHA512

    4d0ccc977560f13341f9885dc7c34d83e805a42aaa2033bf760341654df83706b61c7b75c254568c90e34b506a98ffae7343d568df36072fe68948b702f1e2d7

  • SSDEEP

    768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqh6/agqw:6j+1NMOtEvwDpjrRtqw

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 4 IoCs
  • Detection of Cryptolocker Samples 4 IoCs
  • Detects executables built or packed with MPress PE compressor 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-09_f6f58455eb1c2715be8f60fef0665df9_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-09_f6f58455eb1c2715be8f60fef0665df9_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2748
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Executes dropped EXE
      PID:2628

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    43KB

    MD5

    ac6e9c77f87b12e10c7d7788313cf0c9

    SHA1

    3249f8b574e08f5e575791c0eaea8d5eaa6619a4

    SHA256

    ba41856cf01d46328a64e9f71601e2e3b9f2f74cace3c4071958003b14a8a1f2

    SHA512

    ac3d4aeed80e83921b5ab6e48b1b2f6e8a1155e8d9d0a11c52903986a93db25ddad60385a4c2269e08df1a8dcc7521637d3c8644f76def26e8fe4f844223fb64

  • memory/2628-24-0x0000000000430000-0x0000000000436000-memory.dmp

    Filesize

    24KB

  • memory/2628-17-0x0000000000470000-0x0000000000476000-memory.dmp

    Filesize

    24KB

  • memory/2628-25-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/2748-0-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/2748-2-0x0000000000310000-0x0000000000316000-memory.dmp

    Filesize

    24KB

  • memory/2748-1-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2748-9-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2748-15-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB