Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
163s -
max time network
167s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
12/03/2024, 06:24
General
-
Target
2024-03-12_15ad0ab7df61372b4c48e3873441aad0_cryptolocker.exe
-
Size
45KB
-
MD5
15ad0ab7df61372b4c48e3873441aad0
-
SHA1
40e4f119e0aca11d431e38c2f029352e6c79c2c3
-
SHA256
2e69651f73d58bb27cc188fa63f521a1672c6ce81622d154af3f738f80835d3b
-
SHA512
76e53dad9860d7cd27cfac8885432b55ac977402021f6e9b76d965c591c27fc25ba0018145999eaffbb10796865fbc09fe92faa3e598a9dd16f07692af876b57
-
SSDEEP
768:qmOKYQDf5XdrDmjr5tOOtEvwDpjAajFEitQbDmoSQCVUBJUkQqAHBIG05W2MomF:qmbhXDmjr5MOtEvwDpj5cDtKkQZQa
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-12_15ad0ab7df61372b4c48e3873441aad0_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-12_15ad0ab7df61372b4c48e3873441aad0_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD5e6e713c95adffecee9dcecde3c8ec77a
SHA1ac6ac5c94de1a014e9808a9803170becaa9cfebf
SHA256e6a2f31dce46efb150a9ba7816d5411611326ecdfe3114adb691be39caa85883
SHA512bb239e3339fdece88a95d9bd637bdb19842f003ca6737751d4cd8dee872ab6d6338c35c2643caf90dcf9218ae4b507daf2c976f158da9754ae7207575d06ae7b
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB