Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
04/02/2024, 19:44
General
-
Target
2024-02-04_eb8cca154b5bbafff9eb4d1a94fd9442_cryptolocker.exe
-
Size
51KB
-
MD5
eb8cca154b5bbafff9eb4d1a94fd9442
-
SHA1
432e245facf7adcda631d55e6a5992eedb3d19ed
-
SHA256
b95fdc36e490064f993d433f4cd6dbec53e20b0bff8b952834e363773e3a2ce2
-
SHA512
d950e1d3efd4a47f45d772edfce44cbf4b1171fa1e8dcb2aaaecc9f417c7279f19574c653ffd77426272f4897c005c63a81d5939ed01ff51f9b93bfabc65d5d3
-
SSDEEP
768:79inqyNR/QtOOtEvwDpjBK/rJ+Nw8qn8pKIRs5xwj:79mqyNhQMOtEvwDpjBxe8TpXRWu
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-04_eb8cca154b5bbafff9eb4d1a94fd9442_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-04_eb8cca154b5bbafff9eb4d1a94fd9442_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
51KB
MD5cf2d8e7141a1f240c88d0d15c8814e6c
SHA1df9d675fccd414167574950a199d6ff6fc7f5d2b
SHA2567f6ad90151c87203f3bce44a63cace8a0e8263abc5d0241f21f8001816377f0a
SHA5123910a13d734a7f8a69b2e544cbd2ad38cb50c83facbaee59f263d00bbde94714917dce042ee3e97ebe7a038d15bf272a7418f15fde426fc9d54b854ded158385
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB