Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
27/04/2024, 05:15
General
-
Target
2024-04-27_d3e02d1881a966d04dd6b60268a1e65e_cryptolocker.exe
-
Size
40KB
-
MD5
d3e02d1881a966d04dd6b60268a1e65e
-
SHA1
9379bdd54126ca53dd94324f215fd2f216a7b28f
-
SHA256
9338ab4480e3ce1568595bc76643a6380b9224bd5b06e72c145092059bf29103
-
SHA512
64d8a25bbee2b437a4baa5885d7c1a1d391fc8d03b14a67c4ad5ff91c68292a15960f307f9a6b9a8a453747867c94e1677f87dd6c3209270e5d0e7eab715ca0f
-
SSDEEP
768:XS5nQJ24LR1bytOOtEvwDpj66BLbjG9Rva/yYsZZh:i5nkFGMOtEvwDpjR+viHsx
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 2 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-27_d3e02d1881a966d04dd6b60268a1e65e_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-27_d3e02d1881a966d04dd6b60268a1e65e_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD5fd97c1cfcf816489ed3b7bf88f0e1252
SHA116da27a9c6f016780c888159c6d290c53534a390
SHA256882cb3b84013511ad056b73d5f2761d0b887f78b6167c73667c8bb7f051a0dd4
SHA512fb0e29957465b799a90aca31c12fa57e5a965d9f8a5cf174ec394f84231a2b19dd37ae99b7e4e01fbd19455839be536fabbd149b50f995299960c33ee6c18e4c
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB