Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
14/02/2024, 17:29
General
-
Target
2024-02-14_bc8c01288a10ab43710a5c30c976c64f_cryptolocker.exe
-
Size
63KB
-
MD5
bc8c01288a10ab43710a5c30c976c64f
-
SHA1
42c5cb7080e4bcfa8a6b590c0e0166bf2e0e4196
-
SHA256
c66456ff59c78ae8b6e725c1d2e80534665fb3c054a9e235eae8d01d153644fc
-
SHA512
ca77ab4048a1d7e825fe70d8fe1056072179f2117fe38b1fbfd3e05ea850d0be2d1a89070291394316bc2f6372969be16176b04eb1afd21ccb284935025e2e7e
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5I52kGEO10Km9q:6j+1NMOtEvwDpjr8ox8UDEy0Kms
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
Detects executables built or packed with MPress PE compressor 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-14_bc8c01288a10ab43710a5c30c976c64f_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-14_bc8c01288a10ab43710a5c30c976c64f_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
63KB
MD5f498a49bfd5d77820590ded399edae08
SHA1b939fb94d9f1a9ce01124af22f6e7269ac017a32
SHA2564d11d4e2a71c94aa8da1a9fcd9639cb5d45bcfdc19c7c1796d46233dfa611386
SHA51263e1d76ea6da76707a95c7c3797729d34b3d40b916cf861ac0b19c0f7e6dbd6fcc8da31b31d9dd11f2245c8995f1f2adf7831a3298ffd638aa963a9924d05c64
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB