Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
159s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
06/03/2024, 06:30
General
-
Target
2024-03-06_bc4688f81aa04e459784edcc51a9f7f7_cryptolocker.exe
-
Size
104KB
-
MD5
bc4688f81aa04e459784edcc51a9f7f7
-
SHA1
9765d3c14fa3b4a73ee1179ede2665ba7aa8986b
-
SHA256
116e8273250e7a1c8aec667d93e9c1ff65770bf14254939ccd70ddac6e42165c
-
SHA512
bc700fa780eb944f2472204e0e51b8dc13c9838b11ccfe82e3aeef880c010a3c892751276dfb9c8321050ff5594dcc3492da863f5d02a57053e45f10b77b53f5
-
SSDEEP
1536:P8mnK6QFElP6n+gymddpMOtEvwDpjIHsalRn5iF1j6Gks0R:1nK6a+qdOOtEvwDpjW
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-06_bc4688f81aa04e459784edcc51a9f7f7_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-06_bc4688f81aa04e459784edcc51a9f7f7_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
104KB
MD5fb03cc18aab83ffa6801cfac8a878a6d
SHA1c34b85c75d81f04cd35da79c00b41cdd9e76e66d
SHA256f76659b8e9792a7e40f3a831ab1aa6981a68f4de71a01be2a68e01280bd6c7e8
SHA51282c149208aa0de4793f0da7a088a56c577d9e099b247b1ed73426f1b4b22557d3f7eda6803ee9de7d6d5e2a403cbb715c1aab67266db0d1769122c6723d51fbc
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB