Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
14/03/2024, 07:39
General
-
Target
2024-03-14_683b345c285ef3e3a2b5947ad64fb2eb_cryptolocker.exe
-
Size
62KB
-
MD5
683b345c285ef3e3a2b5947ad64fb2eb
-
SHA1
1ae187cdab72f1671b5abab648b139c9cc4c0564
-
SHA256
a0400ab0e39581dd3485afa67232a2b5ace00fea4da3a4cca00a8c6e0e05e20f
-
SHA512
5db6b3ba49a59fbf34c3de34f3499f00446827679fae52c382a6084d50888acb30600ffc68a10e9dc439f5d69006230dba8ed76dafc207a71908a3e76fdc38b6
-
SSDEEP
1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb61vSbgtstg:BbdDmjr+OtEvwDpjM8O
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-14_683b345c285ef3e3a2b5947ad64fb2eb_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-14_683b345c285ef3e3a2b5947ad64fb2eb_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD556ec42a1fea5fb8dc05a9cda8f5a6606
SHA18f02f4a9dd46a94f183a5bc191882bcd3601e586
SHA256ce43368254490426408130ac5282263c5071f6fe197b45a42d789919292f0f60
SHA51204fb226c7a03e508c980db7e62a59732d3aff436e45196d4b006fd626d17bcd114d3c65f04a17ecc0f2f5a4a4701f3ba4de2f112244c09d293f707c35192d904
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB