Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
14/06/2024, 19:28
General
-
Target
2024-06-14_5010bfc7295d5d7a823b1b27bef4f8af_cryptolocker.exe
-
Size
47KB
-
MD5
5010bfc7295d5d7a823b1b27bef4f8af
-
SHA1
6ed6e1f64571ce6c4e2422b5bf44cd9d4d47cbbb
-
SHA256
ec3d7e17790542be338910902310989e0c00f24c40c1cf6107cbf065a38b1ffe
-
SHA512
b0a33eeb235285f3adb26cb3c5d5688304af0cc5fe2c72c9aefca60f881a85591d063852a1400b1f0754853bcd3326263379d66e15623d00f791094710a7da89
-
SSDEEP
768:79inqyNR/QtOOtEvwDpjBKccJVODvy3ULn:79mqyNhQMOtEvwDpjBzckqUL
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-14_5010bfc7295d5d7a823b1b27bef4f8af_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-14_5010bfc7295d5d7a823b1b27bef4f8af_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD5e3bc11fd4fb6daa545ecafcc12141f10
SHA1d83eab5e65d837125e8e922347eb483bef78ee11
SHA256217727249f5ec0ce572168d6bc1422af29d7ca0a5cab9d3a6571043eab1635cb
SHA512bb0b48288ebbfad975c4689f2593d3e4bdcb897cb29b6ac38ecf7a8026b1e75f799e1667a1df039f147efc2a158cb405162246a2189db18737fc73ee22099364
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB