Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
11/03/2024, 17:27
General
-
Target
2024-03-11_353ee9e7b3e2202ccbdab8c736bf81d8_cryptolocker.exe
-
Size
49KB
-
MD5
353ee9e7b3e2202ccbdab8c736bf81d8
-
SHA1
78e25846df478c0de08d661a455e40a4e740d59f
-
SHA256
21c4511bebd4fc2a23f970409f16c540c4ff7fd76152cd510691a9aa16610a00
-
SHA512
4f448cc3f9218d916b59eadb4327df0aeaf7e988a8bee61aef894f67df9e8b2392d7ee6ee3c5f84e3984afad8dbda80096b91d6f0401d7a00b192ceb3385f06d
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWE6BLbjG9RzhwaSvaB:xj+VGMOtEvwDpjy+TRB
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
Detects executables built or packed with MPress PE compressor 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-11_353ee9e7b3e2202ccbdab8c736bf81d8_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-11_353ee9e7b3e2202ccbdab8c736bf81d8_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49KB
MD5087fac8895cc739f202f71175bc58f7e
SHA1046fba0799db2245e898d3b4a9625d5abbcea609
SHA256cd8ad8f5e6452ec81262bfd9fedef42881e29fc5c86d983e8bf50fece2325634
SHA512f8473a5051af7203b04e2a9b58dd36e881c58ac4bca9e76815a7200ac5c0f0dd6c3e5f2a4a709c830e158b240bc3a7d22b08edb08604a687ca0f6a12cdeff0cf
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB