Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    6s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    11/05/2024, 05:28

General

  • Target

    2024-05-11_1592e5a38867d4ad28f255b366161838_cryptolocker.exe

  • Size

    43KB

  • MD5

    1592e5a38867d4ad28f255b366161838

  • SHA1

    8e6cc4773ac52c0e95cf4a22345c61c8069a3215

  • SHA256

    da289e4a13fcf31d44979a1c1c8648ef0f918d00a1048ecb113f6f331076774f

  • SHA512

    a4f6a25d5ce2ce5f49584f2f8cf4a01344b3a14c1ca188b812c5b01497e57229a26cc8f80a60cb714655c99db558b3ae4d354171c43041c4b36f5b447adc44b0

  • SSDEEP

    768:b/yC4GyNM01GuQMNXw2PSjHPbSuYlW8PA1:b/pYayGig5HjS3NPA1

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-11_1592e5a38867d4ad28f255b366161838_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-11_1592e5a38867d4ad28f255b366161838_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1220
    • C:\Users\Admin\AppData\Local\Temp\retln.exe
      "C:\Users\Admin\AppData\Local\Temp\retln.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2468

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\retln.exe

    Filesize

    44KB

    MD5

    56e26b35b8e309358282c10ba40092aa

    SHA1

    2b906edef1e6f1c4f3281fea1e8aec8c3e8335f3

    SHA256

    5ac54651fd879fe879f8d8324492e59540f7921832506dbb78dac35a37171d4c

    SHA512

    af3da9147fbb9e9ec4afdf38a80f5b2fecb281356ec70573ca82bfb3f360438d0c95b59a0580ca81db51a3ba714a3da6bf74ab46321d0535b3bccdccee9264be

  • memory/1220-0-0x00000000003E0000-0x00000000003E6000-memory.dmp

    Filesize

    24KB

  • memory/1220-1-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/1220-8-0x00000000003E0000-0x00000000003E6000-memory.dmp

    Filesize

    24KB

  • memory/2468-23-0x0000000001CE0000-0x0000000001CE6000-memory.dmp

    Filesize

    24KB