Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
19/03/2024, 04:44
General
-
Target
2024-03-19_816384ce987eb60af9cf43d205339d60_cryptolocker.exe
-
Size
49KB
-
MD5
816384ce987eb60af9cf43d205339d60
-
SHA1
0fed683a0f97d12f2d98ca506367f45a960299b8
-
SHA256
dff85621eb7652e22313123a085d1fd3fb193b8f10856d46fee91808fd317f09
-
SHA512
525c8911540c385c73a2c79cea984926eb06f070ecb7a927568b7fcfbc145bcf65b16811e867ddbdaf918c2d6737804a720e31483f0ad067b314c5ce93aeceeb
-
SSDEEP
768:z6LsoEEeegiZPvEhHSG+gzum/kLyMro2GtOOtEvwDpj/YY1J+Oz:z6QFElP6n+gKmddpMOtEvwDpj31z
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_816384ce987eb60af9cf43d205339d60_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-19_816384ce987eb60af9cf43d205339d60_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49KB
MD59901aa2080980f73c09723d248b49cb9
SHA10f797e5c58f73f165967f86af6a72adaf7d80b36
SHA2560a7a98f802075f47100104207688e87c47f8bd3b671759e0db06f21dfd6683fa
SHA512cd12aa722cc260c2b624911817d3db1ed61fbcac475713bd256fae2c9a1772be451b6a8e9cdd96b7757b5abb3006a6733cfea489563d5149e1dda5ee05ec0f33
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB