Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
06/04/2024, 06:43
General
-
Target
2024-04-06_d328fea08aad7ad1f1f060ba1edef1d9_cryptolocker.exe
-
Size
42KB
-
MD5
d328fea08aad7ad1f1f060ba1edef1d9
-
SHA1
42d0b41785f436c75b01c478729b647214805fd8
-
SHA256
c6da462903bb49df77d3d52f08c513ea6b3b3c71c24f41c7376174c235436f82
-
SHA512
aeb1ce2bc8e07efd5d08f045a348b736e9aa9c065a64f163d46ad396c7118a4206ea2aa2873718a906c3991814385651ed89dbe13482aa0401dafb4483c1a0bc
-
SSDEEP
768:TS5nQJ24LR7tOOtEvwDpjGqPhqlcnvhx5/xFRp5f6:m5nkFNMOtEvwDpjG8hhXj5f6
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-06_d328fea08aad7ad1f1f060ba1edef1d9_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-06_d328fea08aad7ad1f1f060ba1edef1d9_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5a844b9f71bee1cec4c57cb31ad13c999
SHA1dfd86e4e0396bb4f9740f7d88b3f6f7abdb1434e
SHA25645469b3dd250cb89a1bf2732c1242f8b5b6d704d1172c8dc18cb91d4680e38f1
SHA51290649bbc822f6f7415cb731b9a9d0d7d1197625f37cf21c517c39085b1574fe3817169027eb2747c51545cdeac923dcb418b9720e6edb65797351279d162ae4f
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB