Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
03/06/2024, 03:59
General
-
Target
2024-06-03_c8a5490c242d8341ad533ba2d3c2eac8_cryptolocker.exe
-
Size
69KB
-
MD5
c8a5490c242d8341ad533ba2d3c2eac8
-
SHA1
4a8ecdd42843cc4984f25feb3ab9f3b7739e3694
-
SHA256
b04b39d2d999170110d39edec01af423f5bf53f8b6271a33f9cf33e988e2f4ec
-
SHA512
a011a28ee9ee3d1bad6aa708adbd5a5450ae5b1489fe28199febc467aed14f390536281fbf79c58b1955c6f61ceaea1f118ff0eda073b41252a4986a853e3c78
-
SSDEEP
768:XS5nQJ24LR1bytOOtEvwDpjNbZ7uyA36S7MpxRXrZSUNsYD/dx:i5nkFGMOtEvwDpjNbwQEI8UZD7
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
Detects executables built or packed with MPress PE compressor 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-03_c8a5490c242d8341ad533ba2d3c2eac8_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-03_c8a5490c242d8341ad533ba2d3c2eac8_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
69KB
MD5653ad6b0f9e03710b094ad2b6f6cce5c
SHA17d91986f3a87a981a18f442906ef50ec87e24a94
SHA2565c88f1671d7bc3e2c35a05a6cb2e9fc04e4cc76e5842eec6ac0c999cf54c239b
SHA5122f3d329de5667692b43331cbc20584df7972994ee33b6a69c0c63b62669e073e0960e70ceb0421d25f35e911ec5c013bd81df3b9d7ad2af3d70a1cb9778e0872
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB