Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
10/05/2024, 14:37
General
-
Target
2024-05-10_f3a8a48bf0bc62225622ef1f3963986f_cryptolocker.exe
-
Size
61KB
-
MD5
f3a8a48bf0bc62225622ef1f3963986f
-
SHA1
52e03fa3abc34c815f5c8062eb3b742d746472ca
-
SHA256
da38b5551d4dd8b0d1acc749ee97a5c4a680fe21a449cb616793d81c0470aad7
-
SHA512
a0c1032750e961fa6fddbc20c16ff1a857384cc1cdb042fda061730faef2f2692b0813b08869189b8dc15924276ebd16d7a771356b466cb1a6b96789bfd90ac5
-
SSDEEP
768:3Uz7yVEhs9+Hs1SQtOOtEvwDpjO9+4hdCY8EQMjpi/Wpi3B3URiLqCyLuAx8XG9+:3P+HsMQMOtEvwDpjoHy7B3g9CWuAxWz
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_f3a8a48bf0bc62225622ef1f3963986f_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-10_f3a8a48bf0bc62225622ef1f3963986f_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD52f2b50997a7dc68face7efb106357417
SHA1f6b56cf6e3916b9fc2a50b786c23257308646cee
SHA25671f130820024ed7993d511c46368f5011e6c887f546c9c8690064f64216b8c45
SHA512ed0ac7c9aacc1cc5cc03377a06b54801ede1b00ed103d938c5128c72117c64c0d72058d1665aa19e7d0dbe8d2fd645727113fc06e5c410c2e4c8a16e11d9de9b
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB