Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
09/04/2024, 11:39
General
-
Target
2024-04-09_7fe56f7a9961425bee27a9bb84508450_cryptolocker.exe
-
Size
66KB
-
MD5
7fe56f7a9961425bee27a9bb84508450
-
SHA1
c7ed9f2f5f2feff1104f0e95689d5c2daeb1ef29
-
SHA256
8401c76a4e827855b41bec2be042d41f0de0afc21e10c4d222e5ba15cfa33b17
-
SHA512
c21248dcd2815e9eb8d44e436e4ecca22dfd8eaab069eef6ba01feb5e20d4cd7723051105c878e77e799f4da794801a7a8b7104abd6947013deb5b1d3dba7af1
-
SSDEEP
768:quVbxjgQNQXtckstOOtEvwDpjAaDOK6PsED3VK2+ZtyOjgO4r9vFAg2rq6W1A1Pt:quJu9cvMOtEvwDpjWYTjipvF2bx1PQAt
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-09_7fe56f7a9961425bee27a9bb84508450_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-09_7fe56f7a9961425bee27a9bb84508450_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD522d4c46a83f6507f66a16513bd2dbb28
SHA15416a53de7641dd017510cc29133c36498be93de
SHA256f0ae11398a50b75a8e14e616333e135e547badd6a36eba58323c28e79b432726
SHA5127dd70a56266fca78e9fb9d416904fdb76a8bd587ce313aef87f1f631cafac1dfeeb0a1c52b4d4c2ef71d8810a526954a77380aca233765af4c43336dd298cd0d
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB