Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
23/02/2024, 15:05
General
-
Target
2024-02-23_e4efb5b6b4049f7d7ae2aa05c3ed4046_cryptolocker.exe
-
Size
71KB
-
MD5
e4efb5b6b4049f7d7ae2aa05c3ed4046
-
SHA1
02a8edc5ed2c90cab9114bf0c1552d6087e1b80a
-
SHA256
bc044f4e17474b1cb0b282df07be31878bb4e0a2ce578210fc7edc222834253a
-
SHA512
36dd4b5ab8e765485fc73653fc8e6a303ca1b07bcf8bf6a096ee7fd0943e593f75e4b7f39aeeee3bf2650278031e3265b1c45fec6399b8c313c3f8bb7095a192
-
SSDEEP
1536:P8mnK6QFElP6n+gymddpMOtEvwDpjIHsal3SQ:1nK6a+qdOOtEvwDpj8B
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_e4efb5b6b4049f7d7ae2aa05c3ed4046_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-23_e4efb5b6b4049f7d7ae2aa05c3ed4046_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
71KB
MD5c65640dfcafc5cba6d0f122774f81e81
SHA1b9f5036da54be9b81a0cfe999a1de5c755e6009d
SHA256c0de2096706c3cb9459a77db65ecef6b64c27db948c3971a489093139d4b8215
SHA5123e28aad7f565011cfc286fc560945baab04e56da1c8723a3373d87650a96b39f21020cde333676215c681d369979e084cd5473ba30da563d8b8f6003973419b6
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB