Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    25/06/2024, 10:46

General

  • Target

    2024-06-25_32cdf598770921f66574f3ae4e4d40dd_cryptolocker.exe

  • Size

    45KB

  • MD5

    32cdf598770921f66574f3ae4e4d40dd

  • SHA1

    49ce60fcbe2cb1d82628a12ca4713e41abde9370

  • SHA256

    99c7bbcea5acae79bcdef43268944d14b7f09f34da37f0a2c0287fd9e60ca434

  • SHA512

    665bb12bfcdcfb5b08a1e1b12e2b8364e3d61c0c8992714e2b303a03f7c396b470dc80f04511aeae6b74731d11749bd02b00297547f13b8ffaa353f730969326

  • SSDEEP

    384:bm74uGLLQRcsdeQ72ngEr4K7YmE8jb0nrlwfjDUk3r:bm74zYcgT/EkM0ryfjd3r

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-25_32cdf598770921f66574f3ae4e4d40dd_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-25_32cdf598770921f66574f3ae4e4d40dd_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2944
    • C:\Users\Admin\AppData\Local\Temp\hasfj.exe
      "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
      2⤵
      • Executes dropped EXE
      PID:2152

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\hasfj.exe

    Filesize

    45KB

    MD5

    0bc07c67d6e28cce043efa923910db14

    SHA1

    03106cfa502ae1c707109d427e31d1b76fc77a35

    SHA256

    eb834bf80be955344ce36fdb0007911ceed6d4dff8ab5d97378fd7abc88cc3b8

    SHA512

    2b9840d121db4355dae7fc3c8e7b7ad3fabd282265eb52164f2ae9a01f6dbdb9e9be8dc8469601c87b9b2ff74080c362ecbf9e7c2e109730fad9802acd71da80

  • memory/2152-17-0x0000000008000000-0x000000000800D000-memory.dmp

    Filesize

    52KB

  • memory/2152-19-0x00000000002B0000-0x00000000002B6000-memory.dmp

    Filesize

    24KB

  • memory/2152-26-0x00000000002A0000-0x00000000002A6000-memory.dmp

    Filesize

    24KB

  • memory/2152-27-0x0000000008000000-0x000000000800D000-memory.dmp

    Filesize

    52KB

  • memory/2944-0-0x0000000008000000-0x000000000800D000-memory.dmp

    Filesize

    52KB

  • memory/2944-1-0x0000000001B40000-0x0000000001B46000-memory.dmp

    Filesize

    24KB

  • memory/2944-2-0x0000000001B50000-0x0000000001B56000-memory.dmp

    Filesize

    24KB

  • memory/2944-9-0x0000000001B40000-0x0000000001B46000-memory.dmp

    Filesize

    24KB

  • memory/2944-13-0x0000000002F60000-0x0000000002F6D000-memory.dmp

    Filesize

    52KB

  • memory/2944-16-0x0000000008000000-0x000000000800D000-memory.dmp

    Filesize

    52KB