Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    07/01/2024, 19:20

General

  • Target

    20240106c295a0ed45161f1129dbc81096e374d0ransomlock.exe

  • Size

    436KB

  • MD5

    c295a0ed45161f1129dbc81096e374d0

  • SHA1

    ef9c8cc20871bbf4cbc3727c19ad5532ce3961dd

  • SHA256

    a264021abf450d716b145735559ec169f7128597b1714da4f28c82f1570a9348

  • SHA512

    27ab26963dec5cc218284de86c542da77917ff2c163398769767a12fc2196a00e57e00c1e96a7262fdf87cc42fbd28f7b9b2a11cb046d1a6af81879a034e170a

  • SSDEEP

    12288:7MSU4joci8M6PW1GVFeFd60DFUyhe5YM:ASUCpM2W1Gvgmye5v

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\20240106c295a0ed45161f1129dbc81096e374d0ransomlock.exe
    "C:\Users\Admin\AppData\Local\Temp\20240106c295a0ed45161f1129dbc81096e374d0ransomlock.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    PID:3032
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
      PID:1404

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/3032-0-0x0000000000230000-0x0000000000231000-memory.dmp

            Filesize

            4KB

          • memory/3032-1-0x0000000000400000-0x0000000000474000-memory.dmp

            Filesize

            464KB

          • memory/3032-3-0x0000000000230000-0x0000000000231000-memory.dmp

            Filesize

            4KB

          • memory/3032-6-0x0000000000400000-0x0000000000474000-memory.dmp

            Filesize

            464KB