Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
20/05/2024, 07:09
General
-
Target
2024-05-20_f6283fba06d0b7bf46249db49c584da1_cryptolocker.exe
-
Size
48KB
-
MD5
f6283fba06d0b7bf46249db49c584da1
-
SHA1
b44145aa2947d3eedd1b2d5bb451d7206d670219
-
SHA256
6450e82eea8309e6cf2517170657d7ec5945762950d82b90a2b6cbb015f697f6
-
SHA512
e6647996d4dfe76c632b31f0a95deb3adaf8b6d683ce2dd09c1668bdd601acdfaa1c742d2a6a6b47d3a80b0c0dbacc31070c4d28faeba355e91a05b57af739f8
-
SSDEEP
768:79inqyNR/QtOOtEvwDpjBKccJVODvy3Sp8Lu:79mqyNhQMOtEvwDpjBzckqSuK
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-20_f6283fba06d0b7bf46249db49c584da1_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-20_f6283fba06d0b7bf46249db49c584da1_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD59cab81fed2b70a8eb8a8ccf14770f7d5
SHA14246e04d58e6c495c111b5412c28e5e4b864fed3
SHA2565a64c327116d891dba6247623f38d8d66c4a8105a55b70bf171f84df87e315ed
SHA512aee138d9467b3761ef3e815b51675cf24020bb4d90f8e7d7dbeb71969e283437c883a46eb6873e6194b1316d14ef7db0b4f7c4f0cff067acb2a2425916d7f17b
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB