Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
22/02/2024, 19:34
General
-
Target
2024-02-22_4cf2a61eee5e341a99c27f510f6d4e8a_cryptolocker.exe
-
Size
87KB
-
MD5
4cf2a61eee5e341a99c27f510f6d4e8a
-
SHA1
c30e533605cc5fc78bda1dc58de1ee561931ca13
-
SHA256
abef61aa480af3056ddb80ba152e8dee0b5f3d13d288e760c6b766fe45c4cfde
-
SHA512
b0f6315397d8bfa6b0879c7b61583434186f81ccb552946d33a7634006a8646dc1c8834ce66dc2f47c7ecb5d4433c15deb9988cf33837feea15a53a84d1d6a19
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwMgSv:AnBdOOtEvwDpj6zW
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-22_4cf2a61eee5e341a99c27f510f6d4e8a_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-22_4cf2a61eee5e341a99c27f510f6d4e8a_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD504bff620c9452ad5b8eca1cb99601156
SHA165a770623fb5cec019f0e9e2d59efc363b12b3e9
SHA256f30249e9092e68124efc930ca314fc5bc7ad3f03bf1d57e0b0c818364edf5ece
SHA5124d94d75dc57ceded396acd4c5ca11e6cad0e14c91adf0a2dfa04ba89c61b0d3cc025d2926d855254fc733d7d669d67b5b77d729aa346d92dcbac1864d2b8b4a6
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB