Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
05/04/2024, 23:39
General
-
Target
2024-04-05_ddc0b1aef25ddb1524803ffaede3323c_cryptolocker.exe
-
Size
40KB
-
MD5
ddc0b1aef25ddb1524803ffaede3323c
-
SHA1
dc84e40cf619455fbc36a5b38d228a59c4dffc67
-
SHA256
862e05a33b80e4bc70e5afb64cf742930c2b54689d8743f5d51aadee1c8df598
-
SHA512
e5255750b2264d6dc025c2de8b8154787155b4983c75fcf7a5f00cf7307146f64eb257cb33a6ffbcc9512bba015386c2b7a43e7f4db8485fac640ce9798f7fa5
-
SSDEEP
768:TS5nQJ24LR7tOOtEvwDpjGqPhqlcnvhx5/xFRYzv:m5nkFNMOtEvwDpjG8hhXyzv
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_ddc0b1aef25ddb1524803ffaede3323c_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-05_ddc0b1aef25ddb1524803ffaede3323c_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD5c52fa354401eff42f7cf0bf7de3039b3
SHA1ba880d3dfcf072592e7973a0e986c6506e92dd4b
SHA25626de0ba77ae07fe4ed9324d884e595493a54c45e9cfb2db093ca0eedf810728a
SHA5128e4a817922c10910648db06f725a6443064622206d458f06899d421f6215d7e3e1f2dc31b1d04d5b492487555aa1a433c2029a71654810b982074f4052742be5
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
56KB