Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
19/04/2024, 00:37
General
-
Target
2024-04-19_99f72a65bc49c6012f8e2c56ff449e53_cryptolocker.exe
-
Size
72KB
-
MD5
99f72a65bc49c6012f8e2c56ff449e53
-
SHA1
e0f502fea48b44ca6cb7b917a83d4bc268249473
-
SHA256
5ef44dbb12f261835b7add96fa450d61aff48f9ed9f69e4fedde3790da35a30a
-
SHA512
e9a759c975f4d18509400181bc3ef0f2154249b0c0d50d8876a5d379317dd543c9b85d5063674d76a1dd5587633b1b8a5b30a0c29665c685ea419c1aa3006f2d
-
SSDEEP
1536:X6QFElP6n+gJQMOtEvwDpjBZYTjipvF2bx1svq:X6a+SOtEvwDpjBZYvQd28q
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
-
Detection of Cryptolocker Samples 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-19_99f72a65bc49c6012f8e2c56ff449e53_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-19_99f72a65bc49c6012f8e2c56ff449e53_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD58dd099b73e2120c6f39d6db35cfb965f
SHA1ee2944a54aa283cf1dff88a898d9a4a70ecc8296
SHA256ab839f7fe5ec64c55a97f669348221cb789d3a5542b2cb43d20cf82bcbef24a3
SHA512179d68e2a6cebd399793c992a45f7599ebf291bbb41d789cfdde5c93c63f0f8fb212f1e0d7017c4d2ba429248373fc2d75f046e6a5e48e2c9b982698d0f18646
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB