Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
03/05/2024, 23:29
General
-
Target
2024-05-03_88c5a5e1e0a4fcaf8061c7dd6364e4de_cryptolocker.exe
-
Size
63KB
-
MD5
88c5a5e1e0a4fcaf8061c7dd6364e4de
-
SHA1
8001bf6eb2780444084f132c3c84ba132b1e1d7e
-
SHA256
03aaf69b5743766011decf3fd8eab699db05ac686447ec84459995ecf46a639f
-
SHA512
0eaa193c6c66c44a096cd88ecbd16d20188c4d662cb9953840a3007edeab2767995ce2ec7e1bb8cc93f8f764f0b28c3de3a7f14f67edb204dd841ef4b217b170
-
SSDEEP
1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb61vSbgtsi+:BbdDmjr+OtEvwDpjM8b
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-03_88c5a5e1e0a4fcaf8061c7dd6364e4de_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-03_88c5a5e1e0a4fcaf8061c7dd6364e4de_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
63KB
MD58d85feb25fcffdab1f1a7887686132fd
SHA1a26c7ca3399e7c852b253366da7b68129548bc2c
SHA2564abe32994ad40d68b752da251056563aaace945dd8e8d3a76c0cbdd9aab60363
SHA5120df96b29c537ee31daadf280fe8575a6119820c935091b3c214f3b4f2ca3237822e0a3aa11543bc7b389e52d294b5a39649b9c2bcff210364aaadb4d39c2e3cd
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB