Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
27/05/2024, 18:46
General
-
Target
2024-05-27_ed88d6c79983eb0686eb54fc98a81e74_cryptolocker.exe
-
Size
57KB
-
MD5
ed88d6c79983eb0686eb54fc98a81e74
-
SHA1
b708afd7618b1a92252f8a08cd06802c1cd8cd69
-
SHA256
f79c17360159127a86fa6f31bbfd527ce3e63f9a33e71e41c7bc45fa7c51ba3f
-
SHA512
b82dae5de89222db0f3ba358945ba97fa206d4be02a4102ea955b8c7734031252f3c8de7c289fbffb740b78bbcf8f04975a3ab48c0e2cc51a532e2e252cdc2ee
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5QJz7/e4P:6j+1NMOtEvwDpjr8oxExe4P
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-27_ed88d6c79983eb0686eb54fc98a81e74_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-27_ed88d6c79983eb0686eb54fc98a81e74_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD504d00acfa3a4fed3b42b50971aa7d731
SHA1ae4800e7d1b7250b3536d527731e2c0cb311c0cc
SHA256d3c5c8ba6187077ef3d0080bd064c368db8040aa2dcccbf13e3fb22978e1f4c4
SHA512907886b2a7a0fb44f99a0f472439e83ca839be3f79413daa10fa76ed0377cf5e96e0472f7592db55307c4d7ecc02848f1f4df956431aaf13a7368ae734f4a578
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB