Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
27/03/2024, 05:43
General
-
Target
2024-03-27_b19ab53c9eae891c0cf528dae6b86b5e_cryptolocker.exe
-
Size
63KB
-
MD5
b19ab53c9eae891c0cf528dae6b86b5e
-
SHA1
5a513b2a84f4c19fd53d7089d3df67b03cc5132e
-
SHA256
690dbb9adfe55efaaa843807d58b3067f2f8da1ec331de00e2138e5182e6e96b
-
SHA512
8d308a9162d048f56788346bc7520cb14751c1778aac8204b0d8dc5e967095106c8a2e32cafd4f98aac2d6f4aaf647d113588554fc578d508bd372a9f9a8565e
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5I52kGEKI+:6j+1NMOtEvwDpjr8ox8UDEKF
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-27_b19ab53c9eae891c0cf528dae6b86b5e_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-27_b19ab53c9eae891c0cf528dae6b86b5e_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
63KB
MD501d711d5abed9b842a6dc17eec20a857
SHA15614e51754d480e23152fe98ee13f27d518d285a
SHA2567466d152d83dc06c91b419668dd451eea1ee90405ce96c7cd1045350ce96fca8
SHA512b02117d504fa77254999e60cc5a20bf5563de44179fe7bf3d56a0148d22ff9969d4a3ff051ec9ebe9af76e192b11bc365019c21c464dbad743c0084e6b3e074d
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
60KB