Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
14/06/2024, 07:38
General
-
Target
2024-06-14_469da5abf8ca7db67c4f3777c5538c3f_cryptolocker.exe
-
Size
43KB
-
MD5
469da5abf8ca7db67c4f3777c5538c3f
-
SHA1
9157fcf723e1f31633d5ffedb33408425ce3f80b
-
SHA256
c3a5563c4ff6455c30d2fb42b3de6420128266a760a1719415e28886c9e72d4b
-
SHA512
d7e836e7fdfdf0a3e41583f5c3bb1054aad618cfd9bf70a6efca29e8a14a57b5f9a94a9d5361e131c8d300101283adf34d3a1c5edb7a5bc1153a6400633c8059
-
SSDEEP
768:XS5nQJ24LR1bytOOtEvwDpj66BLbjG9Rva/yYsZnTl:i5nkFGMOtEvwDpjR+viHsH
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
Detects executables built or packed with MPress PE compressor 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-14_469da5abf8ca7db67c4f3777c5538c3f_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-14_469da5abf8ca7db67c4f3777c5538c3f_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD5a9add33f442c30bb9f6c9e20e1011a36
SHA178941c4976582fe2b976887d6d66def8f7fbb23f
SHA256fb13b8e3f752db77c037ae9447052317b6ce533b8f94027066b5ab94b872da42
SHA512776a8bca91af4a6c1a63680365a52aa4f7fabca448a4d6e365d664a13854e535e653fa4c3640de02bd18e018abe6f0b281d3066c2a5d8736227743b3ad47d6bc
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB