Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
14/03/2024, 10:53
General
-
Target
2024-03-14_fbb0599435f91fbb71f9f6ffa9e8b185_cryptolocker.exe
-
Size
121KB
-
MD5
fbb0599435f91fbb71f9f6ffa9e8b185
-
SHA1
fea04c159ab06f019595b6e429e4a21335ce9f17
-
SHA256
4dcaded451d0923cd4e269cb5d71edd9e377058f0ed7b74c1668bd631625dbb5
-
SHA512
1f0226408efbc9e228b5df10d5a77c1eb58632722514e5d4b471cbc68c392322c71313c147dcf3e45b32f9193bc415665eab8352d51c8a4a9bf8c5a339993f5c
-
SSDEEP
1536:z6QFElP6n+gKmddpMOtEvwDpj3GYQbN/PKwNgpwqWsviy9t3x:z6a+CdOOtEvwDpjczM
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-14_fbb0599435f91fbb71f9f6ffa9e8b185_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-14_fbb0599435f91fbb71f9f6ffa9e8b185_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
121KB
MD51ec78d23b2ab6b69e314a9fdf76d04c7
SHA1af3289b74a28c9b50849faf10f097482bfdcabad
SHA25626d88e67a2a2dae40cd954863272b088162b6ce599784658ff1d9536f4d236bf
SHA51247b3bf08721f6a98e61f424a3171452cebbcbd2046309eb4ec2cb97607dd3414505ddd5d13569a15a7dfdaa9a183a73e9321d3d6ee33eb3fb10b699a9d00e83f
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB