Analysis
-
max time kernel
4294212s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
19-03-2022 07:12
Static task
static1
Behavioral task
behavioral1
Sample
a8b945595d20c4157464b57a7bf665e8b8d3df060018ef06e87b4d03bbbffb35.exe
Resource
win7-20220311-en
0 signatures
0 seconds
General
-
Target
a8b945595d20c4157464b57a7bf665e8b8d3df060018ef06e87b4d03bbbffb35.exe
-
Size
565KB
-
MD5
cb767cd30e2fc7e8e12c27b4e8a5d367
-
SHA1
f94c105aacfcccc356cad7b8fe631cb27b3e6c20
-
SHA256
a8b945595d20c4157464b57a7bf665e8b8d3df060018ef06e87b4d03bbbffb35
-
SHA512
9087f912a06e6ae980225d1e31b249300e1ae88dd8a6e66ccd5747770a3f9127ea63e7a9dbd0090cb581c67ad8911de575f8852fe8fac76f36c47529f8a8b4d2
Malware Config
Signatures
-
DarkVNC Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1800-58-0x0000000010000000-0x0000000010089000-memory.dmp darkvnc behavioral1/memory/708-66-0x00000000003A0000-0x0000000000469000-memory.dmp darkvnc -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a8b945595d20c4157464b57a7bf665e8b8d3df060018ef06e87b4d03bbbffb35.exedescription pid process target process PID 1800 set thread context of 708 1800 a8b945595d20c4157464b57a7bf665e8b8d3df060018ef06e87b4d03bbbffb35.exe WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
a8b945595d20c4157464b57a7bf665e8b8d3df060018ef06e87b4d03bbbffb35.exepid process 1800 a8b945595d20c4157464b57a7bf665e8b8d3df060018ef06e87b4d03bbbffb35.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
a8b945595d20c4157464b57a7bf665e8b8d3df060018ef06e87b4d03bbbffb35.exepid process 1800 a8b945595d20c4157464b57a7bf665e8b8d3df060018ef06e87b4d03bbbffb35.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
a8b945595d20c4157464b57a7bf665e8b8d3df060018ef06e87b4d03bbbffb35.exepid process 1800 a8b945595d20c4157464b57a7bf665e8b8d3df060018ef06e87b4d03bbbffb35.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
a8b945595d20c4157464b57a7bf665e8b8d3df060018ef06e87b4d03bbbffb35.exedescription pid process target process PID 1800 wrote to memory of 708 1800 a8b945595d20c4157464b57a7bf665e8b8d3df060018ef06e87b4d03bbbffb35.exe WerFault.exe PID 1800 wrote to memory of 708 1800 a8b945595d20c4157464b57a7bf665e8b8d3df060018ef06e87b4d03bbbffb35.exe WerFault.exe PID 1800 wrote to memory of 708 1800 a8b945595d20c4157464b57a7bf665e8b8d3df060018ef06e87b4d03bbbffb35.exe WerFault.exe PID 1800 wrote to memory of 708 1800 a8b945595d20c4157464b57a7bf665e8b8d3df060018ef06e87b4d03bbbffb35.exe WerFault.exe PID 1800 wrote to memory of 708 1800 a8b945595d20c4157464b57a7bf665e8b8d3df060018ef06e87b4d03bbbffb35.exe WerFault.exe PID 1800 wrote to memory of 708 1800 a8b945595d20c4157464b57a7bf665e8b8d3df060018ef06e87b4d03bbbffb35.exe WerFault.exe PID 1800 wrote to memory of 708 1800 a8b945595d20c4157464b57a7bf665e8b8d3df060018ef06e87b4d03bbbffb35.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8b945595d20c4157464b57a7bf665e8b8d3df060018ef06e87b4d03bbbffb35.exe"C:\Users\Admin\AppData\Local\Temp\a8b945595d20c4157464b57a7bf665e8b8d3df060018ef06e87b4d03bbbffb35.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/708-62-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/708-66-0x00000000003A0000-0x0000000000469000-memory.dmpFilesize
804KB
-
memory/1800-54-0x0000000075081000-0x0000000075083000-memory.dmpFilesize
8KB
-
memory/1800-56-0x0000000000220000-0x0000000000273000-memory.dmpFilesize
332KB
-
memory/1800-57-0x0000000004800000-0x0000000004873000-memory.dmpFilesize
460KB
-
memory/1800-55-0x0000000000400000-0x00000000047F9000-memory.dmpFilesize
68.0MB
-
memory/1800-58-0x0000000010000000-0x0000000010089000-memory.dmpFilesize
548KB
-
memory/1800-61-0x0000000000400000-0x00000000047F9000-memory.dmpFilesize
68.0MB
-
memory/1800-63-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/1800-64-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB
-
memory/1800-65-0x0000000000400000-0x00000000047F9000-memory.dmpFilesize
68.0MB