Analysis

  • max time kernel
    589s
  • max time network
    1611s
  • platform
    windows10-1703_x64
  • resource
    win10-20240221-en
  • resource tags

    arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
  • submitted
    20-03-2024 03:15

General

  • Target

    Ransomware.CryptoWall.zip

  • Size

    59KB

  • MD5

    ef0fff38bd2c9dfdb24d73c6861dcb9e

  • SHA1

    f17b98dcdd5a93f0a9ea3961de381ff3898add56

  • SHA256

    8bccc78422858ec95ce2b9b29e53c1ae4aacfd37fdcc35d38e90410ef8cd8c0b

  • SHA512

    04f5299c1905d4f4da18585cf843273aa547c4e4d84b84befff9da749d5690ce378dc7b9dd19d77bd54761ede5f9bf8c388bb7563dffb0045023c580792fcae9

  • SSDEEP

    768:LIa0DdTKY1MaPGlD5cmttnlNndZJjOvkFRxlRS49hF3ZI+ozfbq8GyeYgS3Qb90S:MhgaPaWmf/1jO0RVnPo7OQewjT8Z

Score
1/10

Malware Config

Signatures

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Ransomware.CryptoWall.zip
    1⤵
      PID:4960
    • C:\Windows\system32\msinfo32.exe
      "C:\Windows\system32\msinfo32.exe" "C:\Users\Admin\Desktop\ConnectWrite.nfo"
      1⤵
      • Checks SCSI registry key(s)
      • Enumerates system info in registry
      • Suspicious behavior: GetForegroundWindowSpam
      PID:3092

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Discovery

    Query Registry

    2
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads