Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
21/05/2024, 05:23
General
-
Target
2024-05-21_cb367e4008a624c53e85f3873a6f6bfc_cryptolocker.exe
-
Size
44KB
-
MD5
cb367e4008a624c53e85f3873a6f6bfc
-
SHA1
085638b906f73a6fff345a1a4cd9e96d0d4dc5ec
-
SHA256
48a63229cb8fc011d664e7e19dbf66bdecff5c3cc030adc644a56ee0a16e0687
-
SHA512
4735f18408fba8939d3d5ae2c9007299ce723667f2da8303bedba1d7b680fee866e41ad0dbc0a0a20ab7486193c8ed49646776f6095cb44cd20dcea10562a6a1
-
SSDEEP
384:bm74uGLLQRcsdeQ72ngEr4K7YmE8jo0nrlwfjDUIDw:bm74zYcgT/Ekn0ryfjvw
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_cb367e4008a624c53e85f3873a6f6bfc_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-21_cb367e4008a624c53e85f3873a6f6bfc_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\hasfj.exe"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44KB
MD536ce88b272590a42b8abb158cf3a4d16
SHA1f5c5ccb356341334e5848af77ffab1969d3d54f1
SHA2565e2c8980859bda762de05bfafb2bd4803bf2f93e434144f1690ceea6f7c451cb
SHA512b4871bad56b36aa75997efdc502ef243295f65b028c385ab1a668ec028237560b71a62557ea25fe56f1fab1563050a6699fe0effe9260a11a33e6ce4120b9f5b
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
52KB