Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
26/01/2024, 02:22
General
-
Target
2024-01-26_06c864b764d59b4b4f05d39fc7171b2e_cryptolocker.exe
-
Size
56KB
-
MD5
06c864b764d59b4b4f05d39fc7171b2e
-
SHA1
74afbdf27f7108ed0ed136810a78dd708be237df
-
SHA256
309151278f65310dfe4156c365285fc4b7dc34dcf712f76e761dccd8d59a1526
-
SHA512
9ca00be67a3b6250968eda23aaf084aa27faecab261fa6c7c20e40ebb84f88d3c2e469b5b1b006011b33cdfb87d9ffc2df72f70b1f01d74d63193df6d37417fa
-
SSDEEP
768:zQz7yVEhs9+syJP6ntOOtEvwDpjFeV0ZOfcpLzbO:zj+soPSMOtEvwDpj4yzbO
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_06c864b764d59b4b4f05d39fc7171b2e_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-26_06c864b764d59b4b4f05d39fc7171b2e_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD5477e073411aace68923bbd6307aaf11a
SHA11928f71a969eb4ee4d71d9696e1a6e4fe7934948
SHA25605a02238519914ab5fd3f6112ee6e6c51b110a573f0784e4f6084d020e061a7c
SHA5127aa42db0267d79f7023f3a4250223d403a48ddc7c4e262ce2fa1094ae0a45c253d420aa87e676197f95b562cd6ff88dcd777480ad6688948b0508177509f2f9c
-
Filesize
56KB
MD578473c3606232bdb7ba29c1e75254d17
SHA1b38153659d16b265bc60bd9b4cab200910abf04c
SHA256dfba0deb925e32d254580af4f5bcfd106b5826ff49bf3b13f93e8e3afcc8a511
SHA5129493cd0b0f97506f9eb69b3e9a9bf5e47542e83e1309fe97e28ba7adb593114102741464ceb5601c2b807fed80d3689fe87adb72ab990416c40eb620ad91773c
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB