Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
30/04/2024, 02:32
General
-
Target
2024-04-30_21c0a081658f024a30ad731ebef9831d_cryptolocker.exe
-
Size
81KB
-
MD5
21c0a081658f024a30ad731ebef9831d
-
SHA1
09e9b91402ca06cede822327aa2f4682d2197dd5
-
SHA256
b88f884e4fedc3e7f632d4f82f3b6182cb16e1567a3cb648e75d1f34329ab344
-
SHA512
6457ff268e54646ae3b9a880c9d5c8bca8b2412f42d898ed07858ac34768b814d2b090ba86c0dc1948a2fc414e7b62362f65b94055688a2799af032668e374a4
-
SSDEEP
1536:zj+soPSMOtEvwDpj4ktBl01hJ0tq1ky7Qp2CEb:zCsanOtEvwDpjw
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-30_21c0a081658f024a30ad731ebef9831d_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-30_21c0a081658f024a30ad731ebef9831d_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
81KB
MD5c806eef5db1f3042caf9fc6f317441fb
SHA127b4da29c17cb77fd7d5f0eae88694feca183f83
SHA256aa47ac6a9c72363616842cce389dfcae4632632265fb2dbac904dbd103bdc825
SHA512333ebd75bb84b47de58cbccbc113495ad515ba9d5ad97d3b8f064cf8f58161af65230aca24fd78979a548d96b3089d0e3ac138c716e2489c06b9f6de6f98c1f8
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB