Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
14/02/2024, 08:37
General
-
Target
2024-02-14_7b2745d2b31177e91eb76ec278a0501e_cryptolocker.exe
-
Size
95KB
-
MD5
7b2745d2b31177e91eb76ec278a0501e
-
SHA1
4d240f06f51eef6adfd8f81f2cdf0287933863b4
-
SHA256
5ec83493c39022504d82a616efe34145ec95eaf591eb45e4e8767aa808faaf99
-
SHA512
0ae3517573bc7a752012d3d1b5a2e8d368680ac87974480a80829ab5ed6f334111a1ad416eef3ca10d9ff76440318d0687df8699a145e791fa2afa8cf4905f65
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgp015r:AnBdOOtEvwDpj6zX
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-14_7b2745d2b31177e91eb76ec278a0501e_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-14_7b2745d2b31177e91eb76ec278a0501e_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD503dd3f351a3549990ac5705d608130ca
SHA1b426d9b96dafa0e965733ff500d5a815f02db44a
SHA2560d4a0ad1460702712db6f8d84a825550222aa47aebb19bf9acb25b429566ea93
SHA5128bce3d9ebd26a6a9e200729aadb2fa3ed9e32d41db996a5470fcc8aab238341319020ddbd7f040951688e069649d7431ee391dfc0c8384f9252a49748d42b669
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB