Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/05/2024, 05:28

General

  • Target

    2024-05-11_1592e5a38867d4ad28f255b366161838_cryptolocker.exe

  • Size

    43KB

  • MD5

    1592e5a38867d4ad28f255b366161838

  • SHA1

    8e6cc4773ac52c0e95cf4a22345c61c8069a3215

  • SHA256

    da289e4a13fcf31d44979a1c1c8648ef0f918d00a1048ecb113f6f331076774f

  • SHA512

    a4f6a25d5ce2ce5f49584f2f8cf4a01344b3a14c1ca188b812c5b01497e57229a26cc8f80a60cb714655c99db558b3ae4d354171c43041c4b36f5b447adc44b0

  • SSDEEP

    768:b/yC4GyNM01GuQMNXw2PSjHPbSuYlW8PA1:b/pYayGig5HjS3NPA1

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-11_1592e5a38867d4ad28f255b366161838_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-11_1592e5a38867d4ad28f255b366161838_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3220
    • C:\Users\Admin\AppData\Local\Temp\retln.exe
      "C:\Users\Admin\AppData\Local\Temp\retln.exe"
      2⤵
      • Executes dropped EXE
      PID:3432

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\retln.exe

    Filesize

    44KB

    MD5

    56e26b35b8e309358282c10ba40092aa

    SHA1

    2b906edef1e6f1c4f3281fea1e8aec8c3e8335f3

    SHA256

    5ac54651fd879fe879f8d8324492e59540f7921832506dbb78dac35a37171d4c

    SHA512

    af3da9147fbb9e9ec4afdf38a80f5b2fecb281356ec70573ca82bfb3f360438d0c95b59a0580ca81db51a3ba714a3da6bf74ab46321d0535b3bccdccee9264be

  • memory/3220-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

    Filesize

    24KB

  • memory/3220-2-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/3220-8-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

    Filesize

    24KB

  • memory/3432-25-0x0000000000700000-0x0000000000706000-memory.dmp

    Filesize

    24KB