Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    07/09/2024, 07:40

General

  • Target

    2024-09-07_d8c4af34cf12d0ce0082d6ce2efa3fe9_cryptolocker.exe

  • Size

    35KB

  • MD5

    d8c4af34cf12d0ce0082d6ce2efa3fe9

  • SHA1

    2581d13dc6010176c8e3d0c4902a5cd110eea055

  • SHA256

    c280dfc21cced11b2212e2854ba403073aa99991e6b409527cd87276f371c653

  • SHA512

    bd3ee633e407b293a4b9368296d4330f5b6c422db0d928fda096efa3aeccdebd2085fa72f6d1389ae53838a758d57a6cf0f11b4ec95c4180d787b8d19b78a56e

  • SSDEEP

    384:bG74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUGTGXuadQGs7:bG74zYcgT/Ekd0ryfjHGs7

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-09-07_d8c4af34cf12d0ce0082d6ce2efa3fe9_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-09-07_d8c4af34cf12d0ce0082d6ce2efa3fe9_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2264
    • C:\Users\Admin\AppData\Local\Temp\hasfj.exe
      "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2796

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\hasfj.exe

    Filesize

    35KB

    MD5

    5a499d5a81f660fc1acaa8708c2534e4

    SHA1

    3cc316e68c9823bfe2c22ba67113147ea6d06a4b

    SHA256

    61662f6911afac0f72d7c6bb1683eead7b259d62c9e136069fb505e7f897d006

    SHA512

    77649d7504d27ff18e40e04566098ca603358a6a85b3da16c52719b015a72df8ac30afca23df688841f3559e40bbd2ba0e878a1550289d13cedef3092717d086

  • memory/2264-0-0x0000000008000000-0x000000000800A000-memory.dmp

    Filesize

    40KB

  • memory/2264-1-0x0000000000800000-0x0000000000806000-memory.dmp

    Filesize

    24KB

  • memory/2264-9-0x0000000000800000-0x0000000000806000-memory.dmp

    Filesize

    24KB

  • memory/2264-2-0x0000000001CA0000-0x0000000001CA6000-memory.dmp

    Filesize

    24KB

  • memory/2264-14-0x0000000008000000-0x000000000800A000-memory.dmp

    Filesize

    40KB

  • memory/2796-16-0x0000000008000000-0x000000000800A000-memory.dmp

    Filesize

    40KB

  • memory/2796-19-0x0000000000320000-0x0000000000326000-memory.dmp

    Filesize

    24KB

  • memory/2796-18-0x0000000000280000-0x0000000000286000-memory.dmp

    Filesize

    24KB

  • memory/2796-26-0x0000000008000000-0x000000000800A000-memory.dmp

    Filesize

    40KB