Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/02/2024, 02:25

General

  • Target

    2024-02-23_2b2a495bb554fcad859a552a6688f95a_cryptolocker.exe

  • Size

    38KB

  • MD5

    2b2a495bb554fcad859a552a6688f95a

  • SHA1

    60e001f5859e43bcc0ca98442f4f60dc898e802a

  • SHA256

    165a62682ec84da1e62ed5f7062b70b0c7d57270fd32144726fcaad93fc3a499

  • SHA512

    4a1921349774b1ad3ee711fffe40e53f51e7ed641ca58685b238a58afc209b6f42e7ee08f60688613a4280f4623312fe1d9211619d42fb6fc138f5056a9565b7

  • SSDEEP

    384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzzcYgUPSznHzl6AJvDSuYlxugfN:b/yC4GyNM01GuQMNXw2PSjHPbSuYlP

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-23_2b2a495bb554fcad859a552a6688f95a_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-23_2b2a495bb554fcad859a552a6688f95a_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4600
    • C:\Users\Admin\AppData\Local\Temp\retln.exe
      "C:\Users\Admin\AppData\Local\Temp\retln.exe"
      2⤵
      • Executes dropped EXE
      PID:4272

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\retln.exe

    Filesize

    38KB

    MD5

    77f88ed15633cb668ec1b1feec0bc69b

    SHA1

    a3fe2246f35ada0f611236a4604419134b621ffd

    SHA256

    9f59e5c40da9230cb5f88c3de14844d11d48f6807d973776134efbf71330bf16

    SHA512

    79ec5e28d0b904677c2d57217ff4ec7aed847e25bf6f9d22ef703303eea56bd1985ce302755e49ec79760bf7d6aca33bdccf011965f1d8997c64a747b1c988c4

  • memory/4272-25-0x00000000020A0000-0x00000000020A6000-memory.dmp

    Filesize

    24KB

  • memory/4600-0-0x00000000021D0000-0x00000000021D6000-memory.dmp

    Filesize

    24KB

  • memory/4600-1-0x00000000021D0000-0x00000000021D6000-memory.dmp

    Filesize

    24KB

  • memory/4600-2-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB