Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    18/10/2024, 03:53 UTC

General

  • Target

    2024-10-18_8883063ba23d6acaae9b279e3e94166b_cryptolocker.exe

  • Size

    46KB

  • MD5

    8883063ba23d6acaae9b279e3e94166b

  • SHA1

    9ea880921666ee4ce564970bdf15c3d575973e89

  • SHA256

    8f637ffdcd465818b8d4999d682dd1d3572bab8468b51e41fa21c01e87b86991

  • SHA512

    1829e2e22e5be3c884a31a97cb1889c79e442773c135bb6d3dd08e2a8c3c94f19e0197b7f4428a869495184bd17a2a9caaaa55cabf4c9a3669c1ca64be1afd34

  • SSDEEP

    768:bao/2n1TCraU6GD1a4X1XOQ69zbjlAAX5e9zQ:bF/y2lFizbR9XwzQ

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-18_8883063ba23d6acaae9b279e3e94166b_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-18_8883063ba23d6acaae9b279e3e94166b_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3020
    • C:\Users\Admin\AppData\Local\Temp\rewok.exe
      "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of UnmapMainImage
      PID:2804

Network

  • flag-us
    DNS
    spinistry.com
    rewok.exe
    Remote address:
    8.8.8.8:53
    Request
    spinistry.com
    IN A
    Response
    spinistry.com
    IN A
    64.98.135.121
  • 64.98.135.121:443
    spinistry.com
    rewok.exe
    152 B
    3
  • 64.98.135.121:443
    spinistry.com
    rewok.exe
    152 B
    3
  • 64.98.135.121:443
    spinistry.com
    rewok.exe
    152 B
    3
  • 64.98.135.121:443
    spinistry.com
    rewok.exe
    152 B
    3
  • 64.98.135.121:443
    spinistry.com
    rewok.exe
    152 B
    3
  • 64.98.135.121:443
    spinistry.com
    rewok.exe
    152 B
    3
  • 64.98.135.121:443
    spinistry.com
    rewok.exe
    152 B
    3
  • 64.98.135.121:443
    spinistry.com
    rewok.exe
    52 B
    1
  • 8.8.8.8:53
    spinistry.com
    dns
    rewok.exe
    59 B
    75 B
    1
    1

    DNS Request

    spinistry.com

    DNS Response

    64.98.135.121

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\rewok.exe

    Filesize

    46KB

    MD5

    031517fcfe90e59f8f168c2ecd037d5c

    SHA1

    30e36fa997757ae3c8cd66097610ea34aea34b39

    SHA256

    0d7949fc199dbe32dab3e0baf168da97ee1a72c109708e032edb8f5171226e08

    SHA512

    af9192d00202da01c08cb1f6029ede60f844737a67ab7be0322262ce0a1771d2b0852779946e6955d884e1e5c79994bb4398214dd6e83897a98cfd89e87f8fd8

  • memory/2804-23-0x00000000005C0000-0x00000000005C6000-memory.dmp

    Filesize

    24KB

  • memory/3020-0-0x0000000000360000-0x0000000000366000-memory.dmp

    Filesize

    24KB

  • memory/3020-1-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/3020-8-0x0000000000360000-0x0000000000366000-memory.dmp

    Filesize

    24KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.