Analysis
-
max time kernel
179s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
06-12-2022 16:49
Static task
static1
Behavioral task
behavioral1
Sample
4a19518be677153ab92e1208e7507dd6adef0de0fa34295dfa5d7ac9efce176d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4a19518be677153ab92e1208e7507dd6adef0de0fa34295dfa5d7ac9efce176d.exe
Resource
win10v2004-20221111-en
General
-
Target
4a19518be677153ab92e1208e7507dd6adef0de0fa34295dfa5d7ac9efce176d.exe
-
Size
360KB
-
MD5
b07325f2686e5c26791424d9de7a5c54
-
SHA1
f7d4163877616c819758c07c8c926a9b60c844fa
-
SHA256
4a19518be677153ab92e1208e7507dd6adef0de0fa34295dfa5d7ac9efce176d
-
SHA512
8f4824daef0b9bf70b7de5994baad455e4a1153c0f3976ebcf2f4b061c77a124f8ca0db9455a6bd8d36cb1c1c7e583964b951eb93571f1aa2c277f91775429b4
-
SSDEEP
6144:7Y56KnPgfagNgMhJAp/WgTO3x5N22vWvLRKKAX5l++SyVI4H:qdgfpN/AxT85I2vCMX5l+Zn
Malware Config
Signatures
-
CryptoLocker
Ransomware family with multiple variants.
-
Executes dropped EXE 2 IoCs
Processes:
Wawbmdknpbal.exeWawbmdknpbal.exepid process 204 Wawbmdknpbal.exe 1740 Wawbmdknpbal.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Wawbmdknpbal.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run Wawbmdknpbal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CryptoLocker = "C:\\Users\\Admin\\AppData\\Roaming\\Wawbmdknpbal.exe" Wawbmdknpbal.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
4a19518be677153ab92e1208e7507dd6adef0de0fa34295dfa5d7ac9efce176d.exeWawbmdknpbal.exedescription pid process target process PID 2652 wrote to memory of 204 2652 4a19518be677153ab92e1208e7507dd6adef0de0fa34295dfa5d7ac9efce176d.exe Wawbmdknpbal.exe PID 2652 wrote to memory of 204 2652 4a19518be677153ab92e1208e7507dd6adef0de0fa34295dfa5d7ac9efce176d.exe Wawbmdknpbal.exe PID 2652 wrote to memory of 204 2652 4a19518be677153ab92e1208e7507dd6adef0de0fa34295dfa5d7ac9efce176d.exe Wawbmdknpbal.exe PID 204 wrote to memory of 1740 204 Wawbmdknpbal.exe Wawbmdknpbal.exe PID 204 wrote to memory of 1740 204 Wawbmdknpbal.exe Wawbmdknpbal.exe PID 204 wrote to memory of 1740 204 Wawbmdknpbal.exe Wawbmdknpbal.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a19518be677153ab92e1208e7507dd6adef0de0fa34295dfa5d7ac9efce176d.exe"C:\Users\Admin\AppData\Local\Temp\4a19518be677153ab92e1208e7507dd6adef0de0fa34295dfa5d7ac9efce176d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Roaming\Wawbmdknpbal.exe"C:\Users\Admin\AppData\Roaming\Wawbmdknpbal.exe" "/rC:\Users\Admin\AppData\Local\Temp\4a19518be677153ab92e1208e7507dd6adef0de0fa34295dfa5d7ac9efce176d.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Users\Admin\AppData\Roaming\Wawbmdknpbal.exe"C:\Users\Admin\AppData\Roaming\Wawbmdknpbal.exe" /w000002203⤵
- Executes dropped EXE
PID:1740
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Wawbmdknpbal.exeFilesize
360KB
MD5b07325f2686e5c26791424d9de7a5c54
SHA1f7d4163877616c819758c07c8c926a9b60c844fa
SHA2564a19518be677153ab92e1208e7507dd6adef0de0fa34295dfa5d7ac9efce176d
SHA5128f4824daef0b9bf70b7de5994baad455e4a1153c0f3976ebcf2f4b061c77a124f8ca0db9455a6bd8d36cb1c1c7e583964b951eb93571f1aa2c277f91775429b4
-
C:\Users\Admin\AppData\Roaming\Wawbmdknpbal.exeFilesize
360KB
MD5b07325f2686e5c26791424d9de7a5c54
SHA1f7d4163877616c819758c07c8c926a9b60c844fa
SHA2564a19518be677153ab92e1208e7507dd6adef0de0fa34295dfa5d7ac9efce176d
SHA5128f4824daef0b9bf70b7de5994baad455e4a1153c0f3976ebcf2f4b061c77a124f8ca0db9455a6bd8d36cb1c1c7e583964b951eb93571f1aa2c277f91775429b4
-
C:\Users\Admin\AppData\Roaming\Wawbmdknpbal.exeFilesize
360KB
MD5b07325f2686e5c26791424d9de7a5c54
SHA1f7d4163877616c819758c07c8c926a9b60c844fa
SHA2564a19518be677153ab92e1208e7507dd6adef0de0fa34295dfa5d7ac9efce176d
SHA5128f4824daef0b9bf70b7de5994baad455e4a1153c0f3976ebcf2f4b061c77a124f8ca0db9455a6bd8d36cb1c1c7e583964b951eb93571f1aa2c277f91775429b4
-
memory/204-132-0x0000000000000000-mapping.dmp
-
memory/1740-135-0x0000000000000000-mapping.dmp