Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
28/03/2024, 15:33
General
-
Target
2024-03-28_c0e42ec15f3798003ea6a5fe67b6a495_cryptolocker.exe
-
Size
94KB
-
MD5
c0e42ec15f3798003ea6a5fe67b6a495
-
SHA1
3eacd64c509f06c3f52172d90055594f0a5dae37
-
SHA256
dea18701649dc2d3da50985bca03e0a119fc10c0b405a6348948668b4bed7cd6
-
SHA512
1db50f3ff0aa6ff6a38a47cb8c46c11a6952bfdf574fa7d1f5eab50ff1bc7867660e95b3e1d4183e7e3595782eec2a8c6ffd3c5216fa037d08be627627ca1c08
-
SSDEEP
1536:zj+soPSMOtEvwDpj4ktBl01hJl8QAPM8Ho6cRDjgx/+e:zCsanOtEvwDpjB/
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_c0e42ec15f3798003ea6a5fe67b6a495_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-28_c0e42ec15f3798003ea6a5fe67b6a495_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD57d1a8bdb09ad06debb5b271225847562
SHA1855b8916d0a6fa42588d47edea8cf04585b11241
SHA25662d8229fc98ece7cb47e064afbae733a3236de4d8af4225ecfe1610a76015290
SHA512d76f250766d093080fbcfef4d9cf696541ba398a8ddabd3f604fa5a19f620ac85d023cb25bb5af73da0a33b6c229cd08d58278090f9b1c825e1b82080c5a270c
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB