Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
24/05/2024, 00:42
General
-
Target
2024-05-24_ba7cbc1a8dc6e2a58d1d49352df43562_cryptolocker.exe
-
Size
42KB
-
MD5
ba7cbc1a8dc6e2a58d1d49352df43562
-
SHA1
926e54204553839cea2822232f0a895835374484
-
SHA256
6983c69fabd76b78e6b89a8216ae75a29fd474ea4ffac5f26e845e6be8bba83f
-
SHA512
575165c068f0cc1655655154c41e86d45a4ce0ed0868e277dd6593e2eb6b3f141ffb6d3f2ceb26d44ac2fd652f07087e69e01897381a76ef837fcfca2dcdeb0d
-
SSDEEP
768:XS5nQJ24LR1bytOOtEvwDpj66BLbjG9Rva/yYshNhn:i5nkFGMOtEvwDpjR+viHshNB
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 2 IoCs
-
Detects executables built or packed with MPress PE compressor 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_ba7cbc1a8dc6e2a58d1d49352df43562_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-24_ba7cbc1a8dc6e2a58d1d49352df43562_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD556eda08e8a7040a9f9ed03bc661503e9
SHA1d13bb3c5758568442bcafad817ea6b1cf19bbb41
SHA2560658095b8b6ffd11a8e1d5d5ddfc1360bcca1b19a43cfb638cbeb467ed97e28f
SHA5129b8779b8c600018cc6ff1c837abc67fc7c0e9eb4a18a30fc48a8ccfeb981af07ddbc7e84160eb6bd7b90fc54a1968d31487a15384498c1748c6e0e2fe73017eb
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB