Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
05/04/2024, 11:45
General
-
Target
2024-04-05_4673e2e17f61aca171b381467f34830a_cryptolocker.exe
-
Size
42KB
-
MD5
4673e2e17f61aca171b381467f34830a
-
SHA1
1980e57bbefdd9776d15d36ad35068db75aa7f63
-
SHA256
d0fd9d8d57cc3c779a74576bbad0eb74a04a4c6c6c783536bad7105071ad9ca8
-
SHA512
783e94564c426a41308f420b580e8efe1e4cca9f88216a20417feb441e39a71ea58e569f5c38aa869a6f1c0c64f539c91694ab513f4d3c7308674ad982d262d6
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqhMWKajnuJ:6j+1NMOtEvwDpjrobW
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_4673e2e17f61aca171b381467f34830a_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-05_4673e2e17f61aca171b381467f34830a_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD5c2947d8ad9745a57f9879b73cd620212
SHA135b64b2d0ceccc8914bd7a71431705f71b421186
SHA256bcc3d9179c4c36c756eb79186ac3bd66c0c3fed30c77e48ac0c79f81f0ecfbc0
SHA5123154674f30314f9bf83788278c69d32d16deeea62487950471e5bb3b76849d5847647e218ecd14389c0ff6d9aaa048efd7c0c39daec6e1e2812d435171257ac1
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB