Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    20/08/2024, 15:22 UTC

General

  • Target

    2024-08-20_4e7b8417a7ba6dbab9ed868c3d781262_cryptolocker.exe

  • Size

    35KB

  • MD5

    4e7b8417a7ba6dbab9ed868c3d781262

  • SHA1

    2441f818862c743936b5e8ff0dfe5560b30defc4

  • SHA256

    a13c7ce1757e7db7fd31d6ce8363ad3e4100c04f2709586bdf8aeb657ea4216d

  • SHA512

    37f387ec8c4ce02809c0814679cebf4125c0c1570e747f41163bb3b68a510e8db53c2c7fb90bc55aed523f5a4abc2801ca8732f564c443d79d57f1f4887ab536

  • SSDEEP

    384:bG74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUGTGXuadQd:bG74zYcgT/Ekd0ryfjHd

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-08-20_4e7b8417a7ba6dbab9ed868c3d781262_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-08-20_4e7b8417a7ba6dbab9ed868c3d781262_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1756
    • C:\Users\Admin\AppData\Local\Temp\hasfj.exe
      "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2180

Network

  • flag-us
    DNS
    mytarta.com
    hasfj.exe
    Remote address:
    8.8.8.8:53
    Request
    mytarta.com
    IN A
    Response
No results found
  • 8.8.8.8:53
    mytarta.com
    dns
    hasfj.exe
    57 B
    130 B
    1
    1

    DNS Request

    mytarta.com

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\hasfj.exe

    Filesize

    35KB

    MD5

    892ea659b34690950b5dd0ee031d0fe3

    SHA1

    e0146330da384139b46b6b57623ad16e59ba78fb

    SHA256

    22352eba57b1ea96beeeb296a8de4cfb5ac244fbc8536bc0642df6ebcc81c156

    SHA512

    e6abc9c90841e44be980de54425947c708a68ffea6f76f03274fbb6cb1d1bc7cd031f443d32953a731a5cbf96b69abecfc12b9c454aaf0c0fea7555b352c7ef1

  • memory/1756-0-0x0000000008000000-0x000000000800A000-memory.dmp

    Filesize

    40KB

  • memory/1756-1-0x0000000001B40000-0x0000000001B46000-memory.dmp

    Filesize

    24KB

  • memory/1756-9-0x0000000001B40000-0x0000000001B46000-memory.dmp

    Filesize

    24KB

  • memory/1756-2-0x0000000001B50000-0x0000000001B56000-memory.dmp

    Filesize

    24KB

  • memory/1756-14-0x0000000008000000-0x000000000800A000-memory.dmp

    Filesize

    40KB

  • memory/2180-17-0x00000000004D0000-0x00000000004D6000-memory.dmp

    Filesize

    24KB

  • memory/2180-24-0x00000000004C0000-0x00000000004C6000-memory.dmp

    Filesize

    24KB

  • memory/2180-25-0x0000000008000000-0x000000000800A000-memory.dmp

    Filesize

    40KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.