Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
09/04/2024, 01:30
General
-
Target
2024-04-09_38c972dc11529a49f494e5fe570d0a0e_cryptolocker.exe
-
Size
64KB
-
MD5
38c972dc11529a49f494e5fe570d0a0e
-
SHA1
3507529c679f5f8e82a08838f3915e36ef58ccdd
-
SHA256
485bc00f09d1b171d1a339b1a8b6dd2d64c00b0adf168df8ccdb94af42e3ee12
-
SHA512
90e2f882f66cf80e7d88096b7a15aa39cc6e45819b2a6994ea21829f1886cc6420da4fb97b16cd9f74dd25c201b02173d7e36decdc7a1d197b32f37b1f9011d6
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5I52kGEO10KmJP:6j+1NMOtEvwDpjr8ox8UDEy0KmJP
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-09_38c972dc11529a49f494e5fe570d0a0e_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-09_38c972dc11529a49f494e5fe570d0a0e_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD56cfd16f2d7f1744a2d63c2ee212ea094
SHA1e7e9494be43f893149008fb72b6d581b169ccc8e
SHA256695bb1c8d7f41a7c215036b32523188961733424b3e25da420ea8018d792c109
SHA5122a5d97e89a4395cb22e149dac32b001c91a9bdc4bd43a412323f834a366ba477b8088fe69585199f0f2c1b77ce2afd3d52180d777d5209be19c99465046217e0
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
60KB