Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
30/05/2024, 17:23
General
-
Target
2024-05-30_033af87b560081f55c648b2c05804b5f_cryptolocker.exe
-
Size
65KB
-
MD5
033af87b560081f55c648b2c05804b5f
-
SHA1
83525c6b74c0f2f9103ab047d79b3e25f6b20479
-
SHA256
17fb268398950e92bc82550258b94c00733918a715f6f23f1e5f671183ffdccd
-
SHA512
9a6fcd537187bdc08edc012a39f4021861e3fece759da4d092c5fc08f975c8e9a80b71729e24654a7f852a31ce1b7a48c13542ff55c9178ba09bca76da0a9a56
-
SSDEEP
1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMTIzYI:TCjsIOtEvwDpj5HE/OUHnSMH
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-30_033af87b560081f55c648b2c05804b5f_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-30_033af87b560081f55c648b2c05804b5f_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD50fcd9ab05882a3aaaa32a669095e2c08
SHA15aa4495d425ed1a2d8535f3b2eba7c51789d4d74
SHA25637918fadde71fb07872c40da0da478712f5ae06e552b656fa6847516c940e30f
SHA51283272586532b80dfd0bc4dd69b3c481d9dec8182684eb2c9f9b0c5c3f4b108b7f05ac53fb45d21bb7367f8bae6be5ac5e829c0896ee5b07d8bde5f19b23e1ac3
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB