Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
29/03/2024, 15:32
General
-
Target
2024-03-29_61853bcb0426a0bb3590184241640ee8_cryptolocker.exe
-
Size
73KB
-
MD5
61853bcb0426a0bb3590184241640ee8
-
SHA1
a22839025bd103b0bdfd169c7c6eaee1edd3d7f9
-
SHA256
9e17fd301dc1f7b675799871d299880861eca4a0fe7271db67aa62d4ae758b81
-
SHA512
daafc51bf1aa05e398225cf3ae5959781902e98dbf72fcd9c52b319f8e0c6a8d3911d67a8e2ea730fa524466e2fda61fc5e1094afeb787628a5a5c2dea51f898
-
SSDEEP
1536:X6QFElP6n+gJQMOtEvwDpjBZYTjipvF2bx1rHMU:X6a+SOtEvwDpjBZYvQd2L
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
-
Detection of Cryptolocker Samples 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-29_61853bcb0426a0bb3590184241640ee8_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-29_61853bcb0426a0bb3590184241640ee8_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD563332af79762c2b88a7a867eec805a93
SHA1ad1bb2683880947e49b37bfaa7316b75b41646e3
SHA2565b2387ecbc897b8b60401f848bbffe44a9030bb92f23b4acf3682d6f0e55dc31
SHA512308a69d8ea2de087759fa5ddf5ff85b8cafd49efbf6799c2769a6aecd807eda0b4759d42a1230306f404c6b344c2e1c78475a0f60715a94b1b426cd8213435be
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB