Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/05/2024, 01:25

General

  • Target

    2024-05-17_7f028eaf61b90fa0fd23c0f5a7459f30_cryptolocker.exe

  • Size

    37KB

  • MD5

    7f028eaf61b90fa0fd23c0f5a7459f30

  • SHA1

    b63a13a8ff9f967d6adbbc278a73a7ca6394b34e

  • SHA256

    8ca79af7a5e61a7a72cd473ce3d77476214bf100b340b58cb0145a4191217e1e

  • SHA512

    aae32340c630f764a7df2e76f14eecce9f48d09850e68d978da7b0d816a7842abc589d6959dd655adcd4655cb96e3e5523c8c7aa2a8f66c9bfe0d36bceb8b7cd

  • SSDEEP

    384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzzcYgUPSznHzl6A0X/EIjxua6sY:b/yC4GyNM01GuQMNXw2PSjH+PPxAsY

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-17_7f028eaf61b90fa0fd23c0f5a7459f30_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-17_7f028eaf61b90fa0fd23c0f5a7459f30_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4276
    • C:\Users\Admin\AppData\Local\Temp\retln.exe
      "C:\Users\Admin\AppData\Local\Temp\retln.exe"
      2⤵
      • Executes dropped EXE
      PID:4572

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\retln.exe

    Filesize

    37KB

    MD5

    78dbdbf9f3f4fb9dbddf367475c56bff

    SHA1

    70475eb35ffc13341dc43d4aac2de734d84c87c5

    SHA256

    65d3624b9fb02eb5f934f9e9e12baed8a5b722f7f5da09b00079bbb6435260a8

    SHA512

    a58c15d2b8d9f89b25c0eddebc7acb5f622830ed684c5431ff62cb019c7a52e68b1602de780bfff035d2f6349e8b901a1e9a436854e8b82b787237edfdb2ab44

  • memory/4276-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

    Filesize

    24KB

  • memory/4276-1-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/4276-8-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

    Filesize

    24KB

  • memory/4572-25-0x0000000002000000-0x0000000002006000-memory.dmp

    Filesize

    24KB