Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
05/06/2024, 06:22
General
-
Target
2024-06-05_f8aec2faf3f15e6284aa45ce6548992b_cryptolocker.exe
-
Size
40KB
-
MD5
f8aec2faf3f15e6284aa45ce6548992b
-
SHA1
cc7db7b3e8a47c3df2392cf3f9963ac68e6f31c8
-
SHA256
b3f19e8412d8073bf650cc6a9be86fd2538080960e76861122dbe89d8de206c2
-
SHA512
de24b13baf1b74ea9a31d5271776a23b3c4c2e3744ef908fd54f5da5ae05b897fe6b3ef257ee30f0eb991bbcedc1c1ce7887502d912c16069e82aedf028a6cb9
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITY9Xm:qDdFJy3QMOtEvwDpjjWMl7TV
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-05_f8aec2faf3f15e6284aa45ce6548992b_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-05_f8aec2faf3f15e6284aa45ce6548992b_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD536e3e80c749a17c65c701936ad348ab0
SHA1551048d3983997b005c234abdbf1c0738c29be19
SHA256dc8a282cad1d5d7329c3c8a3e93c81b3ebc6f3afd5e550807ec622515ea5300b
SHA512f32190f234c0a3fb750427ecb6990708ee527e0bef3319275427960451eea0db6298825688bfb25c3e772ec3c53e97baeef7350bd58a16f600bb17d92329cf29
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB