Analysis
-
max time kernel
66s -
max time network
48s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
13-12-2021 10:39
Static task
static1
Behavioral task
behavioral1
Sample
WinCrypto Ransomware.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
WinCrypto Ransomware.exe
Resource
win10-en-20211208
General
-
Target
WinCrypto Ransomware.exe
-
Size
4.4MB
-
MD5
27786f44811d4832d01246e529b94320
-
SHA1
b31bd516fe0ca01cd139739867ae2c60054dc328
-
SHA256
5c396be42657aecabd75f8be6ac9b3af96fa1243a4a50214b3543617f39d6c5b
-
SHA512
1904e09f2a963b725493bb11b9b18f43ffb9e132114bdcd3f05816ee80d50fcca181482bced3fafd739c425b09e6864bec93bbc4ea1365da7ffdb1dc81734dea
Malware Config
Extracted
C:\Users\Admin\Desktop\README WINCRYPTO.txt
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
WinCrypto Ransomware.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\OperaSetups = "C:\\Users\\Admin\\AppData\\Roaming\\RuntimeBroker\\RuntimeBroker.exe" WinCrypto Ransomware.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WinCrypto Ransomware.exedescription pid process Token: SeDebugPrivilege 760 WinCrypto Ransomware.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
WinCrypto Ransomware.exepid process 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe 760 WinCrypto Ransomware.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\WinCrypto Ransomware.exe"C:\Users\Admin\AppData\Local\Temp\WinCrypto Ransomware.exe"1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\README WINCRYPTO.txt1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Desktop\README WINCRYPTO.txtMD5
ce428ffea12027325e2e625d6b3640e0
SHA1fc86cf1db00d03002f4a4e3adddee4a545817092
SHA25698e77b44361b33bc2d45b19762acabcc1f3ae0b534ace69017327eae91bf08a7
SHA512bfe419ab68e92893f211f778de34c06ded97d30283c56c15f69a82bb5c37d1b0e4168ad37bd5cbb5a537d3c19812292ce9998230b9d27fddac382cfa63f0963f
-
memory/760-54-0x0000000000380000-0x0000000000381000-memory.dmpFilesize
4KB
-
memory/760-56-0x0000000000C00000-0x0000000000C36000-memory.dmpFilesize
216KB
-
memory/760-57-0x0000000004FA0000-0x0000000004FA1000-memory.dmpFilesize
4KB
-
memory/760-58-0x0000000004FA5000-0x0000000004FB6000-memory.dmpFilesize
68KB
-
memory/1208-59-0x000007FEFB711000-0x000007FEFB713000-memory.dmpFilesize
8KB