Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
20/02/2024, 13:30
General
-
Target
2024-02-20_9c1f5722cd94723870bb82e5bbee914c_cryptolocker.exe
-
Size
69KB
-
MD5
9c1f5722cd94723870bb82e5bbee914c
-
SHA1
f403061dacd1626a6368ea171ea7a6fe5d6a8cc9
-
SHA256
3b79c893f0b2c417648bcf9d7d2be7a520a5edeffb776e745dff71e3ad8b44c9
-
SHA512
6834279e08e718a57d6074f69858a57007fdd4c00c9c97ac3fdcc7fddd91633ab3bbff6ecd30a36079934b0e9d920240e8cab58aebb1b5643f6b5b59468542de
-
SSDEEP
1536:Dk/xY0sllyGQMOtEvwDpjwycDtKkQZQRKb61vSbgZ3QzNKUH/:DW60sllyWOtEvwDpjwF85h
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-20_9c1f5722cd94723870bb82e5bbee914c_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-20_9c1f5722cd94723870bb82e5bbee914c_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
69KB
MD56d49f207220729456589484a0743480c
SHA19ac8d321f66a1bcf39bce3e3fd9e611e7b8a9740
SHA25683cdada5de7f1c0d041d9cedc6a2f29990af87a973d95ea6d30d7882b1e9879b
SHA51257cf38306a9f731d2ea59a1d54bb47e1df626aa0d6f77a8ec4b1af3874f6e418ef3785b4c45290cf292d376306044717adf80387179372b26c785e3ef8e674b5
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB