Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    17/10/2024, 16:34

General

  • Target

    2024-10-17_e652e3bddc276cd5076d14e773410c6d_cryptolocker.exe

  • Size

    75KB

  • MD5

    e652e3bddc276cd5076d14e773410c6d

  • SHA1

    33741f3ce5f3c2004a04a36a0692cc96b8cdb1d7

  • SHA256

    c20300516b4c4475e4a7a010f00976da950e7af258a07aa74526ab94488e0409

  • SHA512

    d88f6f3535ac5b95d58fdb5840d3d9f3ac6d2fb1009f5cd9c05aa19e31220996676e5e4a33fd24bc85029b64acdd225577968a76fa4c33084dfd1b7fc401b8b9

  • SSDEEP

    1536:vj+jsMQMOtEvwDpj5HwYYTjipvF2hBfIufE:vCjsIOtEvwDpj5H9YvQd2w

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-17_e652e3bddc276cd5076d14e773410c6d_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-17_e652e3bddc276cd5076d14e773410c6d_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2656
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2752

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    76KB

    MD5

    2f9d30bbf7cc4d36c75b7ce95b2a8524

    SHA1

    6cc6fa15c65d28323d69f19cb2479d6a6df0913b

    SHA256

    8b8a75936bb95f58cc51d9cec3fa35c821aefe2f4e8e96b2047b2ae0dbfbde02

    SHA512

    29273bd620e73f6eb2705f8eada92bd3d0fcb4869d4d8e94299637f4dd5ee55fd5bb291db65dc56e4a1a1234efa36bc182cd1036e5015d90b044661cac521526

  • memory/2656-0-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2656-1-0x0000000000280000-0x0000000000286000-memory.dmp

    Filesize

    24KB

  • memory/2656-8-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2752-15-0x00000000004F0000-0x00000000004F6000-memory.dmp

    Filesize

    24KB

  • memory/2752-22-0x0000000000250000-0x0000000000256000-memory.dmp

    Filesize

    24KB