Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
24/01/2024, 03:30
General
-
Target
2024-01-24_362f6c9dd2a67227f23722b70098af54_cryptolocker.exe
-
Size
47KB
-
MD5
362f6c9dd2a67227f23722b70098af54
-
SHA1
8f0e758f7039699d4ff15251b4e7279d553ce85c
-
SHA256
e16a882a61d0cf036819fdfb0777193782a630b03f7a2c009fd6dc61cd89f7ed
-
SHA512
24a3f3e1fbde7bdeb965cae9ed7e71230b10706d0917da47b5d63a0fb76a3199766309d1f14bdd8d71c45a9e0b0d622552c25a963ae9cc1bf05fb2f1c133d344
-
SSDEEP
768:qmOKYQDf5XdrDmjr5tOOtEvwDpjAajFEitQbDmoSQCVUBJUkQqAHBIG05WtyU8je:qmbhXDmjr5MOtEvwDpj5cDtKkQZQPdUt
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-24_362f6c9dd2a67227f23722b70098af54_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-24_362f6c9dd2a67227f23722b70098af54_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD5b2ebace7e8846ab243da6e5ca8c20c60
SHA18eda96c3d4e2cb096dc5b9967eb35f5585c6ae15
SHA256ff90e86bdd3f935fe9972225f9eb3db24f6de3d76446f607ab724607a9d73bf7
SHA512b08da8699b9f4264fa37e4648a2cebb839754053547300df2ba5d52090cae277e54cb27062e33d7d4954222756b950bbbbc967d390db39cbbd716d4eb052667e
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB