Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
21/04/2024, 04:38
General
-
Target
2024-04-21_e5a1280f649da9528aa31809e491c347_cryptolocker.exe
-
Size
46KB
-
MD5
e5a1280f649da9528aa31809e491c347
-
SHA1
9a7cc7c834a0413d5c7cc78eb9ffb2528fdd5ad7
-
SHA256
d62c6030cccf470d6dc03f969aaf8eaf82c6c3680bcc69142141ccc23128fd73
-
SHA512
e99a8316cf56e2b224c1ccbefff1c666662ec471667f0e5e3f926edcc50dc306a80b715bfd6ea13d1ff9bb2d28c5a6a6ea84dc0eedbff1d7a1d174fec9b38359
-
SSDEEP
768:79inqyNR/QtOOtEvwDpjBKccJVODvccwDFUu:79mqyNhQMOtEvwDpjBzck1Wx
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-21_e5a1280f649da9528aa31809e491c347_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-21_e5a1280f649da9528aa31809e491c347_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD5aab04f0c11a5601589d9c596c0fd92eb
SHA161de610398045ca17a2337333d54e4604e557748
SHA2562857939435516db4cee7a399ad86b646484c51cf4c3d37fa915b53c72486b4d7
SHA51298809e58078369735baf8fd815e63a84a59bc762014c11dccfb4e2c404dba2bd90790eebeee02537ee5291102dc5aba9a634331de4eff572af8e3ebaf9e125fd
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB