Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
13/02/2024, 21:29
General
-
Target
2024-02-13_5085ada1b0f46d6b4e692b4c937bf4dc_cryptolocker.exe
-
Size
93KB
-
MD5
5085ada1b0f46d6b4e692b4c937bf4dc
-
SHA1
fb9f25e905385ba553deb2bbfd28a3c4769457eb
-
SHA256
0da077d071fe7cd61a854d39f27a1f798094e462ce8b21497daa8aec4a83fe2a
-
SHA512
fe98c79f9e8897c7e13f02aa77c7a3e758f2f54711741065fdf79e97e09dbdd68b94a39dc37bb0d4fd883342e61c045c6786034c1bd4f14b61ac3f89ba456d0b
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZ7uyA36S7MpxRiWNa9mktJyj:xj+VGMOtEvwDpjubwQEIiVmkuj
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-13_5085ada1b0f46d6b4e692b4c937bf4dc_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-13_5085ada1b0f46d6b4e692b4c937bf4dc_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
93KB
MD5e259857a6e56f2e87a69f9b29348cdd1
SHA1a40d02693c2293e435f82772703acd4be709692b
SHA256418b70d091c810a6ac427d8234233028b9ba31ea6ce2d37bd1daff5dfa00a5c6
SHA512ef181275129554fb8d3b935293d5cbc0422d3f681ef6a74ff9a3a44da11f583633ea7db5ee2a6e5ddb4dbb009405af7937e2dfbaef3d8f376461fc196fbf1e81
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB