Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    28/06/2024, 15:49

General

  • Target

    2024-06-28_18e76735eb2846527c0984a4a5f4152d_cryptolocker.exe

  • Size

    45KB

  • MD5

    18e76735eb2846527c0984a4a5f4152d

  • SHA1

    05b354da68d841f6130d258c8d0428d6ed6aa23b

  • SHA256

    5c1e654e451906fff72a2445100838a82b8141239b89a2052193867df253d5bb

  • SHA512

    a0b9f1726a4957af8e9eb0bb653d99c8638a81704860f710a6e7f34ddc3a8d4fe5ef5554abf51da0bfb521ca2b3184feb17b4c278fcde26d5a8cd8a9aea53180

  • SSDEEP

    768:bao/2n1TCraU6GD1a4X1XOQ69zbjlAAX5e9zI:bF/y2lFizbR9XwzI

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-28_18e76735eb2846527c0984a4a5f4152d_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-28_18e76735eb2846527c0984a4a5f4152d_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3036
    • C:\Users\Admin\AppData\Local\Temp\rewok.exe
      "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2984

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\rewok.exe

    Filesize

    46KB

    MD5

    084e399b231c9fbb2116f7e9a452a599

    SHA1

    55a7e1a317889c104bee62c8fc4fd231d85c9291

    SHA256

    d2c87d98f659193eb77c157f1878c52046aea7f8756befd29a05478b05b305c4

    SHA512

    2ec0a13312e3ecfb98e8c3c0d5b3f85cae1fef4fb27bb910bc426fae0e0140274126930e01e6f9baf252cc02086fa720773696d944ad2fa564b1d33887cee401

  • memory/2984-23-0x0000000000290000-0x0000000000296000-memory.dmp

    Filesize

    24KB

  • memory/3036-0-0x00000000003C0000-0x00000000003C6000-memory.dmp

    Filesize

    24KB

  • memory/3036-1-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/3036-8-0x00000000003C0000-0x00000000003C6000-memory.dmp

    Filesize

    24KB