Analysis

  • max time kernel
    84s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/01/2024, 19:20

General

  • Target

    20240106c295a0ed45161f1129dbc81096e374d0ransomlock.exe

  • Size

    436KB

  • MD5

    c295a0ed45161f1129dbc81096e374d0

  • SHA1

    ef9c8cc20871bbf4cbc3727c19ad5532ce3961dd

  • SHA256

    a264021abf450d716b145735559ec169f7128597b1714da4f28c82f1570a9348

  • SHA512

    27ab26963dec5cc218284de86c542da77917ff2c163398769767a12fc2196a00e57e00c1e96a7262fdf87cc42fbd28f7b9b2a11cb046d1a6af81879a034e170a

  • SSDEEP

    12288:7MSU4joci8M6PW1GVFeFd60DFUyhe5YM:ASUCpM2W1Gvgmye5v

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\20240106c295a0ed45161f1129dbc81096e374d0ransomlock.exe
    "C:\Users\Admin\AppData\Local\Temp\20240106c295a0ed45161f1129dbc81096e374d0ransomlock.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    PID:4548
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
      PID:3528

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/4548-0-0x0000000000690000-0x0000000000691000-memory.dmp

            Filesize

            4KB

          • memory/4548-1-0x0000000000400000-0x0000000000474000-memory.dmp

            Filesize

            464KB

          • memory/4548-3-0x0000000000690000-0x0000000000691000-memory.dmp

            Filesize

            4KB

          • memory/4548-4-0x0000000000400000-0x0000000000474000-memory.dmp

            Filesize

            464KB