Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
06/03/2024, 05:36
General
-
Target
2024-03-06_2690644a0992ffcaa023d986c4f9b9cb_cryptolocker.exe
-
Size
39KB
-
MD5
2690644a0992ffcaa023d986c4f9b9cb
-
SHA1
01af7e3a811998fb32a51f828ab300932b70824e
-
SHA256
5f43c9e78bc23a8216ffd50d6a1c5bf18f7efbd67f7df36beef4e2248ceb4745
-
SHA512
d9215725b13dbea8fb7671667373f4780120222e8915449522542e8106342f94ac0a45ff0e6173f03534bcc6f5e1e353bf7c36eed9691ffc3177ac3551e57c34
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqhMWKaQt:6j+1NMOtEvwDpjroA
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
Detects executables built or packed with MPress PE compressor 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-06_2690644a0992ffcaa023d986c4f9b9cb_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-06_2690644a0992ffcaa023d986c4f9b9cb_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD50d9f26507873ad3271e39725e923e6da
SHA1b41cced11d1615c8053321ac5d76e20b03cee53b
SHA256a166c59e0020e72e0c37c430eae0b5213828d803b7e0169b4052d947b0c2ac7c
SHA51221757988b49ff0e8644a4a78dcd08394f56aeadbaded04f1df360cb66c764cc01b6316a53f1e246f08fb2e1b9fb4b47aaa1a32fad60c9775d28947b3c7761711
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB