Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
126s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
01/02/2024, 08:45
General
-
Target
2024-02-01_1119422ee478ef056a6a53795dc8e1c3_cryptolocker.exe
-
Size
127KB
-
MD5
1119422ee478ef056a6a53795dc8e1c3
-
SHA1
0c74df85807ba2984d7c9d7612069fb8bac6da08
-
SHA256
4ce4a2c2c6103bf44fcab5106aefa6f80af91e93e454d3414a7d9d1f1c88a222
-
SHA512
809e1155423cc76f7c918ac58abb9f51ec25852fc8b554b386736c757339358a1777f717985922e66c55412adf86ec1d67ad8e2bbcc01c5d6d4e0e51cf1c656c
-
SSDEEP
1536:vj+jsMQMOtEvwDpj5HwYYTjipvF2hBfIuBKLUYOVbvh//jx:vCjsIOtEvwDpj5H9YvQd2Rb
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
-
Detection of Cryptolocker Samples 1 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-01_1119422ee478ef056a6a53795dc8e1c3_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-01_1119422ee478ef056a6a53795dc8e1c3_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
127KB
MD5b418f1183f03367a69d23cb413b2cfa6
SHA16d7b0be3208767c3902fe5d46ef8743cdd4e9856
SHA256d1857f55eb4a9812c359d9954133eca47e5c83db1fd30f09604a92320deb5428
SHA5127e82f938d2d86e8b5b18a10594c9b463e6b1cc3545b793dca20c733d81dedb48e6bbffddbe66500358bdee208b7e19e1fc4c37c462d4a327c6007bb4c129187b
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB