Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
15/06/2024, 19:00
General
-
Target
2024-06-15_b9face1318fd3c19904eaf706eef4abf_cryptolocker.exe
-
Size
42KB
-
MD5
b9face1318fd3c19904eaf706eef4abf
-
SHA1
485ada8036ef294adc479a07a7d9db31d0b08aa2
-
SHA256
eeb61b3ec77073f1bf940203095cc08fb330e52be85c2701c1ad4862006888eb
-
SHA512
eded327ee44dbdb54e50ce74719b7fb249ac673a8544e5acb2319e56f28a6c02ffbb655c3b011a8b3072f8acf5c1de0924abb5d447ecf65f3dd68df2c4d44d94
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYljv:qDdFJy3QMOtEvwDpjjWMl7T6L
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-15_b9face1318fd3c19904eaf706eef4abf_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-15_b9face1318fd3c19904eaf706eef4abf_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5d771da7ee9ac30238691cad1d90c2c9e
SHA188c0fbb1cb1c913f908532269ea43c90c3ad872e
SHA25663a440959b063047a3619c75bf3deacbb6b86856f104122e5fe6a110102113b0
SHA512f5dfd00d06727068a78dc46255034d72818a90dab85f3f58e610f1763a6f05be57daeed7555c923589e5b4c5729c8f8689bf691b79cf82934b3491f2abfa02e3
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB