Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
72s -
max time network
79s -
platform
windows10-1703_x64 -
resource
win10-20240221-en -
resource tags
-
submitted
28/03/2024, 15:36
General
-
Target
2024-03-28_c0e42ec15f3798003ea6a5fe67b6a495_cryptolocker.exe
-
Size
94KB
-
MD5
c0e42ec15f3798003ea6a5fe67b6a495
-
SHA1
3eacd64c509f06c3f52172d90055594f0a5dae37
-
SHA256
dea18701649dc2d3da50985bca03e0a119fc10c0b405a6348948668b4bed7cd6
-
SHA512
1db50f3ff0aa6ff6a38a47cb8c46c11a6952bfdf574fa7d1f5eab50ff1bc7867660e95b3e1d4183e7e3595782eec2a8c6ffd3c5216fa037d08be627627ca1c08
-
SSDEEP
1536:zj+soPSMOtEvwDpj4ktBl01hJl8QAPM8Ho6cRDjgx/+e:zCsanOtEvwDpjB/
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 6 IoCs
-
Suspicious behavior: AddClipboardFormatListener 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 17 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_c0e42ec15f3798003ea6a5fe67b6a495_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-28_c0e42ec15f3798003ea6a5fe67b6a495_cryptolocker.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
-
C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\Desktop\ReceiveSave.ppt" /ou ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\fontview.exe"C:\Windows\System32\fontview.exe" C:\Users\Admin\Desktop\ResetDisconnect.ttf1⤵
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\MountInstall.dib"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService1⤵
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\These.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5f16ec15f470c58c962298438e8311a9f
SHA1687939362a43e359177d929288994b2e9f0342ff
SHA256dcb1e2d8c5bf4b8309f9d3cfde382090593c548d557bef35c5e01ccfc9f45b39
SHA5123610b62eb89e2918448af8740bbb835efb3f2598a7f72445f99760aa4e4c386d4308ba6f7aa2dbb2726ad22c679031c7c2eeea2e1cfb4b6b8d672fbcb5f21e99
-
Filesize
95KB
MD57d1a8bdb09ad06debb5b271225847562
SHA1855b8916d0a6fa42588d47edea8cf04585b11241
SHA25662d8229fc98ece7cb47e064afbae733a3236de4d8af4225ecfe1610a76015290
SHA512d76f250766d093080fbcfef4d9cf696541ba398a8ddabd3f604fa5a19f620ac85d023cb25bb5af73da0a33b6c229cd08d58278090f9b1c825e1b82080c5a270c
-
Filesize
224B
MD5e66d36cbcfd69fdf8db6e5c649137ef1
SHA1c1ce08cca33347fe58f95f78f61c31ac6501f511
SHA25615376656ff62df570727bcac73caf451fbe0599729bb4bf648b5e65b3e97f5f4
SHA51278a8c44885ce2f1a035a3075a50027d6eff5c1adbc4d4d134880b1aced5e5d0f70fb6ca8cb037327ec4890a392b3be84eb85c72f38d4cfac985afab64b7c81bc
-
Filesize
64KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
64KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
696KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
696KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
696KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
696KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
696KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.9MB
-
Filesize
64KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
64KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
696KB
-
Filesize
1.9MB
-
Filesize
696KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
64KB
-
Filesize
1.9MB
-
Filesize
696KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB