Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20/09/2024, 22:23

General

  • Target

    2024-09-20_9b6d00672a57f4232f49bc24574dd720_cryptolocker.exe

  • Size

    52KB

  • MD5

    9b6d00672a57f4232f49bc24574dd720

  • SHA1

    0a326d335fbf202399833000c74af76b6a1c6dce

  • SHA256

    dcd66bff7fbe73decd15ddc701f92d97a8e8d7ae3f35364cdbd952cdec8051c2

  • SHA512

    ee8774dbf8d680ec8f4e71525e52213b6c96515b7f205996c51b1cbbd1c08ee7f867862e8aaff0246fe49e05e17fbad784e4ead5f7602842d34b66c16afb4e6b

  • SSDEEP

    1536:X6QFElP6n+gJQMOtEvwDpjBccD2RuoNmuBLx:X6a+SOtEvwDpjBrO/

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-09-20_9b6d00672a57f4232f49bc24574dd720_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-09-20_9b6d00672a57f4232f49bc24574dd720_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2716
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1192

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    52KB

    MD5

    592e0b47bbd1de4f2545044a77b41692

    SHA1

    fdb525790ccf204994c7522c621bf5a50a48d94d

    SHA256

    95a62b0c509c9a0e9d4ac8f3d22ae61e6e2253518bd0280c7efd32a0f07014fe

    SHA512

    efb3b739c1f4ae32c06589dd430940e6dfce3db17e59fa190d9f66f65d3ba2b3b250948475867689d7cc21d224e241f763ee6f59d0bd6ce953d2bacac11f7075

  • memory/1192-16-0x0000000000490000-0x0000000000496000-memory.dmp

    Filesize

    24KB

  • memory/1192-15-0x0000000000360000-0x0000000000366000-memory.dmp

    Filesize

    24KB

  • memory/2716-8-0x00000000001D0000-0x00000000001D6000-memory.dmp

    Filesize

    24KB

  • memory/2716-1-0x0000000000200000-0x0000000000206000-memory.dmp

    Filesize

    24KB

  • memory/2716-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

    Filesize

    24KB