Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
158s -
max time network
170s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
24/02/2024, 07:32
General
-
Target
2024-02-24_71f75002a4873ea7360152acd11d1135_cryptolocker.exe
-
Size
40KB
-
MD5
71f75002a4873ea7360152acd11d1135
-
SHA1
83ebb969b50539ea5668c985944fd1259c20284b
-
SHA256
4d012851947c0d127d8b7b43694d3f02c36abcc39ab9d4cc4304161368882dfa
-
SHA512
95fbf5ba487b3128244bcbd9ba4adaa00e71d98e2641d00b3efb9ef35523d514a280abe191331811248fb5a5bff66d548612090fa2c4b9726f36378496424913
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqh6/lM:6j+1NMOtEvwDpjrRy
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-24_71f75002a4873ea7360152acd11d1135_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-24_71f75002a4873ea7360152acd11d1135_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD5f109cf79836e29c4d3c8692f20d4adce
SHA1aeaad3011ccf2c8c8bb8f9bd05b7c407fdb2881d
SHA256398a0fde9be05eb0b999cc76333ecbf70c9cfd096c3c94aff580e715e666b9fb
SHA51243d0b538dbe1dca4e55419990cedb5d227688c5d9e271aca6d84a96fc91092669bca69be858a26874ee1b6833031b19cbda317197d1ea0f9cc6921b6dc973eb3
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
60KB