Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
16/04/2024, 08:46
General
-
Target
2024-04-16_cc7d6aca6a99556baddb8d432368b86d_cryptolocker.exe
-
Size
89KB
-
MD5
cc7d6aca6a99556baddb8d432368b86d
-
SHA1
c0944e8cf4d2eb6fbd7dcf9ee0e91cf64d5f6ace
-
SHA256
b26521fa55e9ddd02522294affcda1815c6c736387c718c1ff7a42559662ce7b
-
SHA512
04e7219e584b53cd3408afa67c754be9b4faac32182cccc81d1a6ccf53abae11ecbc168aed576b707fdd5e0f0507009fb8b852ffe3d7c7dd820b102c707b31fb
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwMgddH:AnBdOOtEvwDpj6zz
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-16_cc7d6aca6a99556baddb8d432368b86d_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-16_cc7d6aca6a99556baddb8d432368b86d_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89KB
MD5ffaab51a1f35a9ab46bc277a7908dfa4
SHA1fbe990bcb43f6bceb334d0a0349a83534bc1df07
SHA256b3c71cac48369b2bd77670190b60b9527a04d35827febbce20535273990c7f6b
SHA512f09ab565e8de98ddc1fa364852734758ca5032ae1af82da03bc03fb6c53e8749c951791db044a0d945001bc932f2aa1be88d4d68fffec03aa1a8e19a625fb770
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB