Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
14-12-2024 23:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
876511719fda2fab0438ad29f9cc2f8fd684c1897a88d433f7e9c3f2e85eac0b.exe
Resource
win7-20241010-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
876511719fda2fab0438ad29f9cc2f8fd684c1897a88d433f7e9c3f2e85eac0b.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
876511719fda2fab0438ad29f9cc2f8fd684c1897a88d433f7e9c3f2e85eac0b.exe
Resource
win11-20241007-en
windows11-21h2-x64
8 signatures
150 seconds
General
-
Target
876511719fda2fab0438ad29f9cc2f8fd684c1897a88d433f7e9c3f2e85eac0b.exe
-
Size
749KB
-
MD5
1eac61ee26db9242ba47437a027c47d4
-
SHA1
3a465cb953a62c6c2dd2dc61c9f874c6ad7d8e8c
-
SHA256
876511719fda2fab0438ad29f9cc2f8fd684c1897a88d433f7e9c3f2e85eac0b
-
SHA512
b5966deb188881b3d1fd19f911601e451f2126b757c1341e41048cb8dbd990c411fa8815f0610217a1fd273d193cd3f9c2f199ecb02295d28ca6eeb429f88eb4
-
SSDEEP
12288:ZwtTSWbZzmK1tl8gBVkj6VNQJsojXXKI50XZo/6N3VG:Zwt2WdzxfmVjXr6Zz
Score
10/10
Malware Config
Signatures
-
CryptoLocker
Ransomware family with multiple variants.
-
Cryptolocker family
-
Deletes itself 1 IoCs
pid Process 1900 Wawbmdknpbal.exe -
Executes dropped EXE 2 IoCs
pid Process 1900 Wawbmdknpbal.exe 804 Wawbmdknpbal.exe -
Loads dropped DLL 3 IoCs
pid Process 1656 876511719fda2fab0438ad29f9cc2f8fd684c1897a88d433f7e9c3f2e85eac0b.exe 1656 876511719fda2fab0438ad29f9cc2f8fd684c1897a88d433f7e9c3f2e85eac0b.exe 1900 Wawbmdknpbal.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\CryptoLocker = "C:\\Users\\Admin\\AppData\\Roaming\\Wawbmdknpbal.exe" Wawbmdknpbal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*CryptoLocker = "C:\\Users\\Admin\\AppData\\Roaming\\Wawbmdknpbal.exe" Wawbmdknpbal.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 876511719fda2fab0438ad29f9cc2f8fd684c1897a88d433f7e9c3f2e85eac0b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Wawbmdknpbal.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Wawbmdknpbal.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2340 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2340 taskmgr.exe -
Suspicious use of FindShellTrayWindow 47 IoCs
pid Process 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe -
Suspicious use of SendNotifyMessage 47 IoCs
pid Process 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1656 wrote to memory of 1900 1656 876511719fda2fab0438ad29f9cc2f8fd684c1897a88d433f7e9c3f2e85eac0b.exe 28 PID 1656 wrote to memory of 1900 1656 876511719fda2fab0438ad29f9cc2f8fd684c1897a88d433f7e9c3f2e85eac0b.exe 28 PID 1656 wrote to memory of 1900 1656 876511719fda2fab0438ad29f9cc2f8fd684c1897a88d433f7e9c3f2e85eac0b.exe 28 PID 1656 wrote to memory of 1900 1656 876511719fda2fab0438ad29f9cc2f8fd684c1897a88d433f7e9c3f2e85eac0b.exe 28 PID 1900 wrote to memory of 804 1900 Wawbmdknpbal.exe 29 PID 1900 wrote to memory of 804 1900 Wawbmdknpbal.exe 29 PID 1900 wrote to memory of 804 1900 Wawbmdknpbal.exe 29 PID 1900 wrote to memory of 804 1900 Wawbmdknpbal.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\876511719fda2fab0438ad29f9cc2f8fd684c1897a88d433f7e9c3f2e85eac0b.exe"C:\Users\Admin\AppData\Local\Temp\876511719fda2fab0438ad29f9cc2f8fd684c1897a88d433f7e9c3f2e85eac0b.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Roaming\Wawbmdknpbal.exe"C:\Users\Admin\AppData\Roaming\Wawbmdknpbal.exe" "/rC:\Users\Admin\AppData\Local\Temp\876511719fda2fab0438ad29f9cc2f8fd684c1897a88d433f7e9c3f2e85eac0b.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Roaming\Wawbmdknpbal.exe"C:\Users\Admin\AppData\Roaming\Wawbmdknpbal.exe" /w0000012C3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:804
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2340
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
749KB
MD51eac61ee26db9242ba47437a027c47d4
SHA13a465cb953a62c6c2dd2dc61c9f874c6ad7d8e8c
SHA256876511719fda2fab0438ad29f9cc2f8fd684c1897a88d433f7e9c3f2e85eac0b
SHA512b5966deb188881b3d1fd19f911601e451f2126b757c1341e41048cb8dbd990c411fa8815f0610217a1fd273d193cd3f9c2f199ecb02295d28ca6eeb429f88eb4