Analysis

  • max time kernel
    120s
  • max time network
    113s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    04/09/2024, 02:14

General

  • Target

    cryptowall.exe

  • Size

    240KB

  • MD5

    47363b94cee907e2b8926c1be61150c7

  • SHA1

    ca963033b9a285b8cd0044df38146a932c838071

  • SHA256

    45317968759d3e37282ceb75149f627d648534c5b4685f6da3966d8f6fca662d

  • SHA512

    93dfaafc183360829448887a112dd49c90ec5fe50dcd7c7bbc06c1c8daa206eeea5577f726d906446322c731d0520e93700d5ff9cefd730fba347c72b7325068

  • SSDEEP

    3072:xkeyloECBch6ZCGBGSmHJ0y5lj6jdojK7+MGOXpXx8z3Lp7Yoq:xGlnCIwMpj6ijKfxx8z3F0V

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cryptowall.exe
    "C:\Users\Admin\AppData\Local\Temp\cryptowall.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:4440
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 500
      2⤵
      • Program crash
      PID:4636
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4440 -ip 4440
    1⤵
      PID:4116
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Drops file in Windows directory
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3472
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc1df1cc40,0x7ffc1df1cc4c,0x7ffc1df1cc58
        2⤵
          PID:3728
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1820,i,16227122690389073331,16051114486288759428,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1824 /prefetch:2
          2⤵
            PID:2100
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2108,i,16227122690389073331,16051114486288759428,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2124 /prefetch:3
            2⤵
              PID:3792
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2204,i,16227122690389073331,16051114486288759428,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2152 /prefetch:8
              2⤵
                PID:3720
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3088,i,16227122690389073331,16051114486288759428,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3192 /prefetch:1
                2⤵
                  PID:2352
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3152,i,16227122690389073331,16051114486288759428,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3256 /prefetch:1
                  2⤵
                    PID:2424
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3548,i,16227122690389073331,16051114486288759428,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4388 /prefetch:1
                    2⤵
                      PID:1648
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4544,i,16227122690389073331,16051114486288759428,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4756 /prefetch:8
                      2⤵
                        PID:4268
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4888,i,16227122690389073331,16051114486288759428,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4912 /prefetch:8
                        2⤵
                          PID:1808
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4444,i,16227122690389073331,16051114486288759428,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5044 /prefetch:1
                          2⤵
                            PID:1500
                        • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                          1⤵
                            PID:412
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                            1⤵
                              PID:4252

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                              Filesize

                              649B

                              MD5

                              3fbd4fa515c412cb28ac6993ba4c80a2

                              SHA1

                              dd1332b970d70eb5da8e97db163ed9db7868747b

                              SHA256

                              ffc17257ced6ba103f69ab98c1615eeb49bc2e03a661e42fd4a9a1cc0647f3c4

                              SHA512

                              12ed5024af7fa86c7342466df736ceb399b703342d4a6592993233b8ad2379f387f1fd30e6c164f238c6c6e6d13f2dc52821c4ac5fdbbc14b70a682530a327b0

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

                              Filesize

                              211KB

                              MD5

                              e7226392c938e4e604d2175eb9f43ca1

                              SHA1

                              2098293f39aa0bcdd62e718f9212d9062fa283ab

                              SHA256

                              d46ec08b6c29c4ca56cecbf73149cc66ebd902197590fe28cd65dad52a08c4e1

                              SHA512

                              63a4b99101c790d40a813db9e0d5fde21a64ccaf60a6009ead027920dbbdb52cc262af829e5c4140f3702a559c7ac46efa89622d76d45b4b49a9ce01625ef145

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000002

                              Filesize

                              24KB

                              MD5

                              c594a826934b9505d591d0f7a7df80b7

                              SHA1

                              c04b8637e686f71f3fc46a29a86346ba9b04ae18

                              SHA256

                              e664eef3d68ac6336a28be033165d4780e8a5ab28f0d90df1b148ef86babb610

                              SHA512

                              04a1dfdb8ee2f5fefa101d5e3ff36e87659fd774e96aa8c5941d3353ccc268a125822cf01533c74839e5f1c54725da9cc437d3d69b88e5bf3f99caccd4d75961

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index

                              Filesize

                              216B

                              MD5

                              6b236b08e62c6a49b18267f5b60109f5

                              SHA1

                              b76b5532d280ba2bf5d204516ae6a35cc6fe2a80

                              SHA256

                              3dc99fe906d774878f9fadb0260a72184d62dc7fe967a54d87d9fa6b5ea6ed49

                              SHA512

                              be40c5d817d27c72208101b447577f8ebbdf22e83ba0e06e9cff0371118c347d16d8f583463d92063ec94b9afa5079b61b5746a86f3c6e5072ab2bda4206902d

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              d7f0f837b2558d2639d7bdd7caf11232

                              SHA1

                              21b692ba555fd2241cff16ffaa47f29aae4b4fd2

                              SHA256

                              0a7394ac42e37ccf0cb254235d0a5acba7198ee0a063451cc9d52a3d216b045b

                              SHA512

                              47a5f41a859994c71bbbcb9a1eb60920a63a38a4652ca911c5d372197cd40797fb95a6b038c49b388d7371f0aaf04a1c94098dbb34b9ecb89de86debb1a8a240

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                              Filesize

                              2B

                              MD5

                              d751713988987e9331980363e24189ce

                              SHA1

                              97d170e1550eee4afc0af065b78cda302a97674c

                              SHA256

                              4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                              SHA512

                              b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                              Filesize

                              356B

                              MD5

                              d3651462fcaae4752d4578b647294470

                              SHA1

                              e3b8bff69024be3a488f6fd6c878def68f9641a1

                              SHA256

                              3af2d979c69ad9ae05e20a82ec28388f326d24bd2c08ea7e19fe64cca3cfe05f

                              SHA512

                              1f1317bb3a34e01eb972bc167e49354043a94e942e891332abc6814d76123b88121fa9ba6fce29329be24bf4dd2ada1767a31f1d1a8225fde65e90cbece43989

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                              Filesize

                              356B

                              MD5

                              f696bed69218848947e39e80cf58e8c1

                              SHA1

                              800c4422db2a56164e40f488d3e18709859c06a1

                              SHA256

                              d5bce24b70fd6837df8f03e3a6aa2fea7b5215e29c93474720e4d070a3ae31e3

                              SHA512

                              71726979043eb9b9ba57dce067c9f4c9252c86c3a6a9b713c7dae4939778d37bd0cacc65807d4c1facfcd76632557e9da81bee9d02018f62311fc368d9d363e4

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              9KB

                              MD5

                              4e8d1cf819211be8066e1dfa8e6b4c04

                              SHA1

                              61717bf717f71869c0eddf03df095d3e3dacd4e9

                              SHA256

                              94fdd5fe90e0be8472cc2e977a14daec26ff8cd85b5bfe9e3aab707cc4e8b7c1

                              SHA512

                              3bf521821056a471c11e460890738b76acafd452e5b67f42d54fbfd78242cfa7376a9f944008735fc8c8db1f19cc1b159a2acd5857e4d0e4b936a926778206a2

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              9KB

                              MD5

                              cad49234b0d6780273d5c3ca0d0f6136

                              SHA1

                              e85f91701d5d5fceec1c3a8dd976dae2f1692989

                              SHA256

                              e0757f03ddf00587d483e0740eba2fad2bc8059eb368c7d8ab93632660f1c15f

                              SHA512

                              5d2915ceaf2059118f0e1bd5e0934361c0b302f1cb8205e2573f8ec4bf8b504ad9b76a2dbee0e18ed7acad12f933151c5f352ac01b659fee6742879ccdaf34b3

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              9KB

                              MD5

                              d1afcf34b18f612bc08b969eda588047

                              SHA1

                              8ac542e6066300e2785e477cac83361bf8d1d25e

                              SHA256

                              6f0809211c84ab70a2807111cb0f760d878d1d28f05c34af5bdca868eb5281f8

                              SHA512

                              10e9ef6410ab1f5744eacb2f4650e0fda4e1b79d29288a0d96196ceada299f11efd9d79c7824badf5f04bc590ca3790184f44719eb3cad54cb1050dd9fdb5af0

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              9KB

                              MD5

                              4f193e777369c376c79e4aa503fb050e

                              SHA1

                              bfd08e1e94fa3ed324c5f721c9bfef334fb0a9c2

                              SHA256

                              8132a2cf467de1192666c812c3fc33f62bc40c8108b911cafafceb3be595b029

                              SHA512

                              5dc56bcc0168ef9f9ddf0ccee2005b594fa8fd2af534da65f4d32fae5f805818fb7d2fa77b61246235fdd3af9f6d513711a024da9ac2e069178d81baf9222373

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              9KB

                              MD5

                              37d54c8624f0db34c830f7848beda9c8

                              SHA1

                              bb7f5fd1000beba9563d4956d65425e2b26daf23

                              SHA256

                              d317831fc5806b53f068360ae4b3ac55b200e26a7e692fbd9d4e8dd3cbd5378f

                              SHA512

                              8868230a49db435b4f63c5ecf2612cfbc50fd2d353ac9133382c61768dd4d93ca76f03692cc792020d0cce01e0c385da38f50c730e1b8eecfe962fe13d100aaa

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              9KB

                              MD5

                              7ca8ab86ef397f2a22b3333e5b00f835

                              SHA1

                              006dffce2c819539282d742e9e8e36bb6f514b20

                              SHA256

                              dae955ca9161592d4d4c2d238b3f6af04e49604e38545b30b441a0844df883e8

                              SHA512

                              9840f1767d267c7f662371b5b2871fb908d694ca95975d8cd0201df033ccf3602b7ccb7ecb9b843dbe4a52137f882fda79aa081ab37ec0844e57ae7feda34c56

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                              Filesize

                              15KB

                              MD5

                              b1c57e434781e023757eab04e885c3c1

                              SHA1

                              576047ec0a994df0b035309984e12afea90eda20

                              SHA256

                              d67ed350131f39d0d00dcd393495ce3d8938117cc82b2f9ead93f63c8427254f

                              SHA512

                              1602f8a1bf5378365b911d47a31b0390cd0d1469809926a5290a92fe22e80ab3f5faa45238f6c1d164f6df7820d403aec37bf41f86d3bc01261bb6df2b4597f9

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              204KB

                              MD5

                              9fc7cb3d9021944b429c2a80fa796343

                              SHA1

                              8bc72effa222ada5e070198cedfdb7dba330ce56

                              SHA256

                              4ee29dfc2e83095d8beabffbe2897a254e8ca7382b2b3da7dd183c13ea8d6128

                              SHA512

                              72c2bfbd5e15faeabdcdbe7cc3b63aaf322e179cd5fb95ecf68f9c008ff211f776b9f1569b53c98660435758a4f80277bec389d9656de162088ede30f50af257

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              204KB

                              MD5

                              99cf15e5989d167458c86f6136c5c2fc

                              SHA1

                              c7f8901bd3cf748a497edfc1f9c344aa5026fe25

                              SHA256

                              8b427adcfe63b8ef6eecb8242c0a9e6e90396865fd12695ca6b3b4b5f9aadf42

                              SHA512

                              8538635881e151ba3e42c5bdad8c57df1ffc8c0556a10dba8909391c1c298d11f5efa3634105db4739391b8ee93a88c50b8deea5e1f8cc70d62e9728ed4b74e1