Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
09/05/2024, 03:42
General
-
Target
2024-05-09_3ad291f5ae2ab784fdabccb4f3d77a7f_cryptolocker.exe
-
Size
38KB
-
MD5
3ad291f5ae2ab784fdabccb4f3d77a7f
-
SHA1
7534ac3f9ff44c550a30bcfd3be4c38f171dc997
-
SHA256
9f57d1263ac7b39cfd1cbcd6bcebd406590a52f00d66f68134c5794562412490
-
SHA512
830f734a9763a24264a9b476b793e16effc31cadaf860f583d2da9b8527e351a99679c17785fbe0a3c6786c9af61793365a4e08b3844927b0db972e12cfaf737
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITY2:qDdFJy3QMOtEvwDpjjWMl7Tv
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-09_3ad291f5ae2ab784fdabccb4f3d77a7f_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-09_3ad291f5ae2ab784fdabccb4f3d77a7f_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD5b6243e97756648246707904e065a9a86
SHA1d73ee66d5591798b2ad68461f76f68c2b2f31d64
SHA2561ef890177e25bffc0586fab566afadfff93ea29b7ec30050913f046c23d16661
SHA512fb86e405bb0267be67cc8ef6dd5ed0623f83af942c52f26a62824f586980cc9bd7582bd327d35a3fa8a24b7d146d47a37855dc58d85330bf083e1bcf6e01e31e
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB