Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
09/03/2023, 02:11
General
-
Target
CLodop_Setup_for_Win32NT.exe
-
Size
4.6MB
-
MD5
9a942a2401351f3909fc3f0d94f749fc
-
SHA1
9ca251da1724008388ee672c232a03027b33dfff
-
SHA256
27be7d68516c66d8e3554d116bfe0add4a6dac42c3fb2484da025fccbc963601
-
SHA512
b8f07ffa81bcff1f9684ab1ebe9136517425162c4dd9d12fb7b958629355a49cd75b457972d6858fc23e30f130bf7bfcb515884db496e608dfb01a856d15ffe7
-
SSDEEP
98304:B1e0+EBg+69MH5UCumgFgyOy5V2N+R0G72Lcl+pYP4N/KpC:/eaUBCXDG6BpUHC
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CLodop_Setup_for_Win32NT.exe"C:\Users\Admin\AppData\Local\Temp\CLodop_Setup_for_Win32NT.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-1CH9U.tmp\is-9R23R.tmp"C:\Users\Admin\AppData\Local\Temp\is-1CH9U.tmp\is-9R23R.tmp" /SL4 $80042 "C:\Users\Admin\AppData\Local\Temp\CLodop_Setup_for_Win32NT.exe" 4509903 512002⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
646KB
MD579551e7f460ce4a92b6c9c0f0b714108
SHA151c8cd3741482a00ee6137822f826c0f55d521c4
SHA25606ae7abcec424f92569cd67e55e27c7e91f84f6108f91876cd3f135262341bef
SHA5124e1d7bc491d21064d89414aa335915d306ea3e811d7fe237c9e111b0588189d8d37b238b7ff39159b05125eaee6637956a7f0f8e2ae51a7a5196765af62665a8
-
Filesize
646KB
MD579551e7f460ce4a92b6c9c0f0b714108
SHA151c8cd3741482a00ee6137822f826c0f55d521c4
SHA25606ae7abcec424f92569cd67e55e27c7e91f84f6108f91876cd3f135262341bef
SHA5124e1d7bc491d21064d89414aa335915d306ea3e811d7fe237c9e111b0588189d8d37b238b7ff39159b05125eaee6637956a7f0f8e2ae51a7a5196765af62665a8
-
Filesize
130KB
MD53a57389802e43a5bc4f13e99742c218e
SHA1a070a8d60e85850d85ad650b90ff3afb8ebf6803
SHA25625cd485dd2a9e692637a6860ed3f75f810d8883781d169ee4954170fb800dca6
SHA512c131caed5786cbb4d1c3c31761314676eea6eda2daf42337edb306ea36ed791fc8ae6dff4a7f47eb5182dd1db0c5f30c66a1ca5dadf98d5337c340e8137bff20
-
Filesize
130KB
MD53a57389802e43a5bc4f13e99742c218e
SHA1a070a8d60e85850d85ad650b90ff3afb8ebf6803
SHA25625cd485dd2a9e692637a6860ed3f75f810d8883781d169ee4954170fb800dca6
SHA512c131caed5786cbb4d1c3c31761314676eea6eda2daf42337edb306ea36ed791fc8ae6dff4a7f47eb5182dd1db0c5f30c66a1ca5dadf98d5337c340e8137bff20
-
Filesize
176KB
-
Filesize
4KB
-
Filesize
704KB
-
Filesize
176KB
-
Filesize
4KB
-
Filesize
76KB
-
Filesize
76KB