Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    3s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    17/05/2024, 01:25

General

  • Target

    2024-05-17_7f028eaf61b90fa0fd23c0f5a7459f30_cryptolocker.exe

  • Size

    37KB

  • MD5

    7f028eaf61b90fa0fd23c0f5a7459f30

  • SHA1

    b63a13a8ff9f967d6adbbc278a73a7ca6394b34e

  • SHA256

    8ca79af7a5e61a7a72cd473ce3d77476214bf100b340b58cb0145a4191217e1e

  • SHA512

    aae32340c630f764a7df2e76f14eecce9f48d09850e68d978da7b0d816a7842abc589d6959dd655adcd4655cb96e3e5523c8c7aa2a8f66c9bfe0d36bceb8b7cd

  • SSDEEP

    384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzzcYgUPSznHzl6A0X/EIjxua6sY:b/yC4GyNM01GuQMNXw2PSjH+PPxAsY

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of UnmapMainImage 4 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-17_7f028eaf61b90fa0fd23c0f5a7459f30_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-17_7f028eaf61b90fa0fd23c0f5a7459f30_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2096
    • C:\Users\Admin\AppData\Local\Temp\retln.exe
      "C:\Users\Admin\AppData\Local\Temp\retln.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2704

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\retln.exe

    Filesize

    37KB

    MD5

    78dbdbf9f3f4fb9dbddf367475c56bff

    SHA1

    70475eb35ffc13341dc43d4aac2de734d84c87c5

    SHA256

    65d3624b9fb02eb5f934f9e9e12baed8a5b722f7f5da09b00079bbb6435260a8

    SHA512

    a58c15d2b8d9f89b25c0eddebc7acb5f622830ed684c5431ff62cb019c7a52e68b1602de780bfff035d2f6349e8b901a1e9a436854e8b82b787237edfdb2ab44

  • memory/2096-0-0x00000000003F0000-0x00000000003F6000-memory.dmp

    Filesize

    24KB

  • memory/2096-1-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/2096-8-0x00000000003F0000-0x00000000003F6000-memory.dmp

    Filesize

    24KB

  • memory/2096-0-0x00000000003F0000-0x00000000003F6000-memory.dmp

    Filesize

    24KB

  • memory/2096-1-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/2096-8-0x00000000003F0000-0x00000000003F6000-memory.dmp

    Filesize

    24KB

  • memory/2704-23-0x0000000000380000-0x0000000000386000-memory.dmp

    Filesize

    24KB

  • memory/2704-23-0x0000000000380000-0x0000000000386000-memory.dmp

    Filesize

    24KB