Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
10/04/2024, 19:31
General
-
Target
2024-04-10_71c123b7b14cd25ae73b95da0e5c9f84_cryptolocker.exe
-
Size
78KB
-
MD5
71c123b7b14cd25ae73b95da0e5c9f84
-
SHA1
d3b3fe13eae32dc8897998a61faa29f10bd4a38f
-
SHA256
712fd202cb9fa7bb29ca3cbe98ee1666ff1a6a831689d1d15a8f67ee59de48f4
-
SHA512
8b9d9f2c55d5fd3ebc0f1d32f1019a04abf0baeeaeac15a069ee98e8980fa41ef0018202394218bc4a90e668c16524b8b56821ea4d5f5c75121527542e5a2cca
-
SSDEEP
1536:V6QFElP6n+gMQMOtEvwDpjyaLccVNluoA:V6a+pOtEvwDpjvpW
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
-
Detection of Cryptolocker Samples 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-10_71c123b7b14cd25ae73b95da0e5c9f84_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-10_71c123b7b14cd25ae73b95da0e5c9f84_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78KB
MD588335aa575c00ecfab93a74d023a618f
SHA172188233eb4e4ee7de3e7281f37c2c5a3f032175
SHA25655c8d0c5c49b40813e948a146663b9314360960c043ad8a5d4418dc8f8202105
SHA5125738d4fe9fe7a439c719f2f0e6a8c7dfb4e31c92a9574153470ed15132d2c72c8a52261c2d2009c40692e06bf6b74a7c4f15d82b67396b6cee46466b4881e1ad
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB