Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    12/10/2024, 04:50

General

  • Target

    2024-10-12_20b227bd524e84a3ae01e63a01cbf90d_cryptolocker.exe

  • Size

    5.5MB

  • MD5

    20b227bd524e84a3ae01e63a01cbf90d

  • SHA1

    ac51bb815b96f55a44e7b047e4b450c41f0cb878

  • SHA256

    e8c8a1de615418651be64c24f8f126d8e94e5700511c6af635302f56f3536c02

  • SHA512

    30b05079d6e9def31161044085ecfdf4f1e1f167a01342737d77c367249313c7fde34825b9da465a6d770a9e0f37f23c5069f1af5fc69eec2ccda3575dabd684

  • SSDEEP

    98304:ot1QKvyjzO6B3DenIMmzyxD++XsBq+JUieGNt3sB/a1Ed9m+UfK:otTvgz73XMpxDbcwYvt3sFa4OK

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-12_20b227bd524e84a3ae01e63a01cbf90d_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-12_20b227bd524e84a3ae01e63a01cbf90d_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2256
    • C:\Users\Admin\AppData\Local\Temp\lossy.exe
      "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2184

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\lossy.exe

    Filesize

    5.5MB

    MD5

    41a4b81b1082e7a18d699738e20a2a3a

    SHA1

    1601950e5ea9f1ba7eb354bebae09b6ac196d3e3

    SHA256

    71c21fc197d517b748ab65a957b1def09a40d99a707090f9c3dfed9d06e74ffc

    SHA512

    5715e854acaea1e67c64d110ad9eb038228ad9bb976ab5a974a0579411753a740dda7d2f6f3fa064aeeb4e06b109d1c0754098812aceda9ed41ff02eee185447

  • memory/2184-42-0x0000000008000000-0x0000000008884000-memory.dmp

    Filesize

    8.5MB

  • memory/2184-36-0x0000000000290000-0x0000000000296000-memory.dmp

    Filesize

    24KB

  • memory/2184-33-0x0000000008000000-0x0000000008884000-memory.dmp

    Filesize

    8.5MB

  • memory/2184-34-0x0000000008000000-0x0000000008884000-memory.dmp

    Filesize

    8.5MB

  • memory/2184-32-0x0000000008000000-0x0000000008884000-memory.dmp

    Filesize

    8.5MB

  • memory/2184-26-0x0000000008000000-0x0000000008884000-memory.dmp

    Filesize

    8.5MB

  • memory/2256-8-0x0000000000250000-0x0000000000256000-memory.dmp

    Filesize

    24KB

  • memory/2256-0-0x0000000008000000-0x0000000008884000-memory.dmp

    Filesize

    8.5MB

  • memory/2256-9-0x0000000000360000-0x0000000000366000-memory.dmp

    Filesize

    24KB

  • memory/2256-17-0x0000000008000000-0x0000000008884000-memory.dmp

    Filesize

    8.5MB

  • memory/2256-25-0x000000000800A000-0x0000000008303000-memory.dmp

    Filesize

    3.0MB

  • memory/2256-22-0x0000000008000000-0x0000000008884000-memory.dmp

    Filesize

    8.5MB

  • memory/2256-16-0x0000000008000000-0x0000000008884000-memory.dmp

    Filesize

    8.5MB

  • memory/2256-6-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2256-4-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2256-2-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2256-1-0x000000000800A000-0x0000000008303000-memory.dmp

    Filesize

    3.0MB