Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
29/03/2024, 17:24
General
-
Target
2024-03-29_ea021802265f548e290568f8ddf46775_cryptolocker.exe
-
Size
49KB
-
MD5
ea021802265f548e290568f8ddf46775
-
SHA1
ce6430e4c93a03989cce73f049741a52cf15dbd8
-
SHA256
6552a0f56d3d7211563e77030738fa95e806522380c8f775fb345f943498fee0
-
SHA512
8412d6d73c44fea75cfc5f26cfcb9ac0a11a8c1b8388ca771358e1c230b879eb9dd1b8810bfd751d448255d19516662f650f6ab2120261b74191f7fe52d11429
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPhqlcnvhx5/xFRkHx8:6j+1NMOtEvwDpjr8hhXiW
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
Detects executables built or packed with MPress PE compressor 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-29_ea021802265f548e290568f8ddf46775_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-29_ea021802265f548e290568f8ddf46775_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50KB
MD55d6d6b728109e24576c53f184613533c
SHA1e48c95da7e094ef4e7d1c892bcd300d5bd6b4ce8
SHA2563f189713eb9ed14149b8e1fda87ee0d654885aeac5f5f29190a673e1a7b78818
SHA512f9404a6f8d727b8d73f0c8c0f199fab5c82236755b9e1dd011cc2ad12108cb86236ff502dbae43daa0cc3bf8c433678e82103636f2e094db76d2e3c5792d7d1b
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB