Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
27/01/2024, 12:35
General
-
Target
2024-01-27_cef385b75a2eb489efc474b08a0ee799_cryptolocker.exe
-
Size
108KB
-
MD5
cef385b75a2eb489efc474b08a0ee799
-
SHA1
f75a457796a350e292b548cb5c8e9e361e9bada2
-
SHA256
5ee00381e7ceebdcec11f8195e9ccfb808e985aac23dbf6732e11513f7712bf7
-
SHA512
e278c226d05f4663a4fb22383a2305ea4a87facdf465f69a629d9f58e32cc01956ef2252236f88dd230aadc35a1176a00a6d143ba494c2d77462ac7a5fcaaca0
-
SSDEEP
1536:z6QFElP6n+gKmddpMOtEvwDpj3GYQbN/PKwMg66:z6a+CdOOtEvwDpjczF
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-27_cef385b75a2eb489efc474b08a0ee799_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-27_cef385b75a2eb489efc474b08a0ee799_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
108KB
MD54614f49bbea8fc39dff059c30bc53a4a
SHA14bda572fedecc149ad822d43de4a6a18094abcb9
SHA2563c511f1514ec1a2418138b1081a37978f85539c0ab9b479ffbe13b9469ac85a8
SHA5122881d33cba40564d1d71218a243282a05341d305c90a91e141ac581799e7d98c8dead9b6020969310f12973ad5334457a1bf4106235988939f1ea67f45629ae1
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB