Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/05/2024, 01:29

General

  • Target

    2024-05-28_3e4484ff7ae9201d33b4db6767db8832_cryptolocker.exe

  • Size

    31KB

  • MD5

    3e4484ff7ae9201d33b4db6767db8832

  • SHA1

    2ce091b1254e7e477a59125905e59021d5d36673

  • SHA256

    293e6bcf5cc5b6fd823c6b19add8afe6c8cc5667ee0af3dadf44a8402db87e58

  • SHA512

    acb995a6d752262fff2ecb21ff79cc4581e66fc4dac3e150fdd0a0120e110591c241996f612a3e393f223af8f25aba9b06f5795b80ff67877c69bb9217d4fcc2

  • SSDEEP

    384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zznum+U8Ss87vh3:b/yC4GyNM01GuQMNXum+NSn3

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-28_3e4484ff7ae9201d33b4db6767db8832_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-28_3e4484ff7ae9201d33b4db6767db8832_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:228
    • C:\Users\Admin\AppData\Local\Temp\retln.exe
      "C:\Users\Admin\AppData\Local\Temp\retln.exe"
      2⤵
      • Executes dropped EXE
      PID:1592

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\retln.exe

    Filesize

    31KB

    MD5

    e46cc3d1dabb4928b2abcf056fc41b6f

    SHA1

    be3cbcaa5c3d1019ab1801f789f3f23d20067c40

    SHA256

    58d6dda9aa697d05e4a337d98cf72818fd95b846bef15f4a7985495de483cecc

    SHA512

    f772df1ac9623a0406dab9532721d74afc0b9d97df37dd5c4578e58237cfb55f261f32dfe7d4d4bf559e299d8c4889b2339ea6171c3495f42516c7135aa13e0c

  • memory/228-0-0x0000000002120000-0x0000000002126000-memory.dmp

    Filesize

    24KB

  • memory/228-1-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/228-8-0x0000000002120000-0x0000000002126000-memory.dmp

    Filesize

    24KB

  • memory/1592-25-0x0000000002160000-0x0000000002166000-memory.dmp

    Filesize

    24KB