Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
30/04/2024, 02:59
General
-
Target
2024-04-30_daf297a17f079f7137a550dea945ded5_cryptolocker.exe
-
Size
71KB
-
MD5
daf297a17f079f7137a550dea945ded5
-
SHA1
c71a403ae80b9c79f0a7610373e1fdcfa5b1fb48
-
SHA256
ab48e28b3cec4d0afcb40cfc2c4560e2a2835dda2e3ca76f444b646995f4fb66
-
SHA512
9777542b3e365df4073493a4c60aa4fd415016600244bf63ce44852df50ff9cacc6b77823efbdee1fd33c18202bf3d65622e7f2404d9a887b44c0d013941d2a1
-
SSDEEP
1536:nj+4zs2cPVhlMOtEvwDpj4H8u8rZVTs9r:C4Q2c94OtEvwDpj4H8zO
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-30_daf297a17f079f7137a550dea945ded5_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-30_daf297a17f079f7137a550dea945ded5_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5bc9a235e4ed710c8e1cfd0cd5de53b1d
SHA16dfd7775b53789d0f434759f2195ee6af58f9d3d
SHA2564232ac26a158254e244c2c6f3d3b0fc056c975adaeb31b04834940020e723a51
SHA5129f40ec87a2b95068b53f4535e2a6b2e6d3c6c9ec104d024de2cc8ddf163152a0053a91368c0c00ac5de5215eb170629c3de32c8b734761f9aac44158e18b11d4
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB