Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09/10/2024, 04:37

General

  • Target

    2024-10-09_51022e25e4872bfbaf2013e82624dfbc_cryptolocker.exe

  • Size

    53KB

  • MD5

    51022e25e4872bfbaf2013e82624dfbc

  • SHA1

    4cf76463ac7a6da2526e17f77d7f2c221bb6c0eb

  • SHA256

    493225382996fd09e3392fddc3d2d702776e9dcd474c7863c0e98a58a2d11231

  • SHA512

    7b43515a83c46c8059c45af73d675965d7b509c418b2b247a1c7bdb03876a16a53859a87585de8eaebee9f8fe73765b3203214293668e1d6b3551c7151c21172

  • SSDEEP

    1536:ZzFbxmLPWQMOtEvwDpj386Sj/WprgJN6tZdOyJYwo:ZVxkGOtEvwDpjcd

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-09_51022e25e4872bfbaf2013e82624dfbc_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-09_51022e25e4872bfbaf2013e82624dfbc_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:796
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:856

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    54KB

    MD5

    bb5c62afde3731852dc84c03570535f2

    SHA1

    e7528600b068b26946641e3776483b12eee8714c

    SHA256

    f6a1039e8af24b0eedf2bbd01c4eb2cbe76af68f92bdd4d0fcc1bfc21f460e11

    SHA512

    db58e52f218848c1f28aa33ca3e999d233bf06a467c5d54c13353bfaad64c11119c39e873be98e4e3d669054ac463c88aabe9ee43ab5cb90858b5b71d6168419

  • memory/796-0-0x0000000000230000-0x0000000000233000-memory.dmp

    Filesize

    12KB

  • memory/796-1-0x0000000000430000-0x0000000000436000-memory.dmp

    Filesize

    24KB

  • memory/796-2-0x0000000000470000-0x0000000000476000-memory.dmp

    Filesize

    24KB

  • memory/796-9-0x0000000000430000-0x0000000000436000-memory.dmp

    Filesize

    24KB

  • memory/856-15-0x00000000001C0000-0x00000000001C3000-memory.dmp

    Filesize

    12KB

  • memory/856-18-0x0000000000290000-0x0000000000296000-memory.dmp

    Filesize

    24KB

  • memory/856-17-0x00000000001D0000-0x00000000001D6000-memory.dmp

    Filesize

    24KB