Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
19/03/2024, 23:40
General
-
Target
2024-03-19_ad5faca8181b4ca1dfdf2491dc002785_cryptolocker.exe
-
Size
100KB
-
MD5
ad5faca8181b4ca1dfdf2491dc002785
-
SHA1
422d62c0195909e05926f06f20c77e45331145b1
-
SHA256
e01c52cf9769af13754c1c4b5a89fdc60ce01a4367eb48b49f47e5fa9ea6b420
-
SHA512
c1ecf5b4a67b22beb8f72367ed429855b91b00af4c1ecfc7dfd1ce9e7eec29ff556fcdaf344e212d570cc9f15c706e9f84c02c5352c1b315871f8a0d6ccc3baf
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgpwqWsviPy1Q:AnBdOOtEvwDpj6z5
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_ad5faca8181b4ca1dfdf2491dc002785_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-19_ad5faca8181b4ca1dfdf2491dc002785_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD51df3eb135b008369a36132d2dc1d3f0d
SHA189834476cbd9f9542117841157acbd2a5fff0bc2
SHA2565b80f7079a70a074b9054760eaea2ffe575a328725195c5cf178639e27d99f4f
SHA512c7dc7cd579b5415d53db83eec49e7a30e4bbcbb456aeccf86fb472f986a1ce665880a0783121b10efd6dd9de051818ef79125165b8f6207a79be7607c69c421a
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB