Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
02/06/2024, 08:43
General
-
Target
2024-06-02_6cc89c858529c5ab937d7dded32f76c7_cryptolocker.exe
-
Size
44KB
-
MD5
6cc89c858529c5ab937d7dded32f76c7
-
SHA1
e8fad2002b8ec19a4e3069861c0973366ad54011
-
SHA256
d98285e89f97340565b1f0d99ecffdc5b7dff41c3e3dd117caf10f38ad5c2e0b
-
SHA512
d1d748395c26ae369946f30daa5b1789abd934e868c3a8142a0c8f673a8a11bb45620c038d7bb0d5e4544a258072da0d943d072cb8a7a5f8708768041f37e687
-
SSDEEP
384:bm74uGLLQRcsdeQ72ngEr4K7YmE8jo0nrlwfjDUpamWj:bm74zYcgT/Ekn0ryfjRmA
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-02_6cc89c858529c5ab937d7dded32f76c7_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-02_6cc89c858529c5ab937d7dded32f76c7_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\hasfj.exe"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD5e83fe67108d7ddb2cbd43712314e7605
SHA118048835cb164ed79833822470e4fcf1ebf68518
SHA256ae1dfc0876c6c435aae95af2896c3fe0a6d4c2267e3c94d1f0443e4fb68511fd
SHA51292519af771126c61a7d57617a99095e188d5601c9b6cbfc77663e547c5113bcf36c733ebb88fd16f22453567e794560e06d7ec4ed4d87759f2accb758977c880
-
Filesize
52KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
52KB