Analysis
-
max time kernel
151s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 00:49
Static task
static1
Behavioral task
behavioral1
Sample
detail-information.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
detail-information.exe
-
Size
494KB
-
MD5
07591af2349f8ebc5789fcb0b60c7c91
-
SHA1
828bcdd3d1e32d2ed0b0660fc92f41a562d4d466
-
SHA256
b50a0ea3d467e25e9c1917668e10f70e67434e468fcecbb1d3a927a3f105dbfa
-
SHA512
8bc1068c0d85f62176fe8e23ec23ecbcfaa1296d379c26ff5fe7ee274c5ef7d12b7a1fec44941eca9841af17c61c5c1b3ad50739fb5d5baadd72bf2feef48ad3
Malware Config
Signatures
-
NetWire RAT payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2012-63-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1176-70-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Drops startup file 2 IoCs
Processes:
detail-information.exedetail-information.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe detail-information.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe detail-information.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
detail-information.exedetail-information.exedescription pid process target process PID 1016 set thread context of 2012 1016 detail-information.exe RegAsm.exe PID 1688 set thread context of 1176 1688 detail-information.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
detail-information.exedetail-information.exepid process 1016 detail-information.exe 1016 detail-information.exe 1016 detail-information.exe 1016 detail-information.exe 1016 detail-information.exe 1016 detail-information.exe 1016 detail-information.exe 1016 detail-information.exe 1016 detail-information.exe 1016 detail-information.exe 1016 detail-information.exe 1688 detail-information.exe 1688 detail-information.exe 1016 detail-information.exe 1016 detail-information.exe 1688 detail-information.exe 1688 detail-information.exe 1016 detail-information.exe 1016 detail-information.exe 1688 detail-information.exe 1688 detail-information.exe 1016 detail-information.exe 1016 detail-information.exe 1688 detail-information.exe 1688 detail-information.exe 1016 detail-information.exe 1016 detail-information.exe 1688 detail-information.exe 1688 detail-information.exe 1016 detail-information.exe 1016 detail-information.exe 1688 detail-information.exe 1688 detail-information.exe 1016 detail-information.exe 1016 detail-information.exe 1688 detail-information.exe 1688 detail-information.exe 1016 detail-information.exe 1016 detail-information.exe 1688 detail-information.exe 1688 detail-information.exe 1016 detail-information.exe 1016 detail-information.exe 1688 detail-information.exe 1688 detail-information.exe 1016 detail-information.exe 1016 detail-information.exe 1688 detail-information.exe 1688 detail-information.exe 1016 detail-information.exe 1016 detail-information.exe 1688 detail-information.exe 1688 detail-information.exe 1016 detail-information.exe 1016 detail-information.exe 1688 detail-information.exe 1688 detail-information.exe 1016 detail-information.exe 1016 detail-information.exe 1688 detail-information.exe 1688 detail-information.exe 1016 detail-information.exe 1016 detail-information.exe 1688 detail-information.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
detail-information.exedetail-information.exepid process 1016 detail-information.exe 1688 detail-information.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
detail-information.exedetail-information.exedescription pid process Token: SeDebugPrivilege 1016 detail-information.exe Token: SeDebugPrivilege 1688 detail-information.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
detail-information.execmd.exedetail-information.execmd.exedescription pid process target process PID 1016 wrote to memory of 2012 1016 detail-information.exe RegAsm.exe PID 1016 wrote to memory of 2012 1016 detail-information.exe RegAsm.exe PID 1016 wrote to memory of 2012 1016 detail-information.exe RegAsm.exe PID 1016 wrote to memory of 2012 1016 detail-information.exe RegAsm.exe PID 1016 wrote to memory of 2012 1016 detail-information.exe RegAsm.exe PID 1016 wrote to memory of 2012 1016 detail-information.exe RegAsm.exe PID 1016 wrote to memory of 2012 1016 detail-information.exe RegAsm.exe PID 1016 wrote to memory of 2012 1016 detail-information.exe RegAsm.exe PID 1016 wrote to memory of 1036 1016 detail-information.exe cmd.exe PID 1016 wrote to memory of 1036 1016 detail-information.exe cmd.exe PID 1016 wrote to memory of 1036 1016 detail-information.exe cmd.exe PID 1016 wrote to memory of 1036 1016 detail-information.exe cmd.exe PID 1036 wrote to memory of 964 1036 cmd.exe choice.exe PID 1036 wrote to memory of 964 1036 cmd.exe choice.exe PID 1036 wrote to memory of 964 1036 cmd.exe choice.exe PID 1036 wrote to memory of 964 1036 cmd.exe choice.exe PID 1016 wrote to memory of 1688 1016 detail-information.exe detail-information.exe PID 1016 wrote to memory of 1688 1016 detail-information.exe detail-information.exe PID 1016 wrote to memory of 1688 1016 detail-information.exe detail-information.exe PID 1016 wrote to memory of 1688 1016 detail-information.exe detail-information.exe PID 1688 wrote to memory of 1176 1688 detail-information.exe RegAsm.exe PID 1688 wrote to memory of 1176 1688 detail-information.exe RegAsm.exe PID 1688 wrote to memory of 1176 1688 detail-information.exe RegAsm.exe PID 1688 wrote to memory of 1176 1688 detail-information.exe RegAsm.exe PID 1688 wrote to memory of 1176 1688 detail-information.exe RegAsm.exe PID 1688 wrote to memory of 1176 1688 detail-information.exe RegAsm.exe PID 1688 wrote to memory of 1176 1688 detail-information.exe RegAsm.exe PID 1688 wrote to memory of 1176 1688 detail-information.exe RegAsm.exe PID 1688 wrote to memory of 1032 1688 detail-information.exe cmd.exe PID 1688 wrote to memory of 1032 1688 detail-information.exe cmd.exe PID 1688 wrote to memory of 1032 1688 detail-information.exe cmd.exe PID 1688 wrote to memory of 1032 1688 detail-information.exe cmd.exe PID 1032 wrote to memory of 1392 1032 cmd.exe choice.exe PID 1032 wrote to memory of 1392 1032 cmd.exe choice.exe PID 1032 wrote to memory of 1392 1032 cmd.exe choice.exe PID 1032 wrote to memory of 1392 1032 cmd.exe choice.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\detail-information.exe"C:\Users\Admin\AppData\Local\Temp\detail-information.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\detail-information.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Users\Admin\AppData\Local\Temp\detail-information.exe"C:\Users\Admin\AppData\Local\Temp\detail-information.exe"2⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\detail-information.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 34⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/964-61-0x0000000000000000-mapping.dmp
-
memory/1016-57-0x0000000075F61000-0x0000000075F63000-memory.dmpFilesize
8KB
-
memory/1016-56-0x0000000000440000-0x0000000000443000-memory.dmpFilesize
12KB
-
memory/1016-54-0x0000000000220000-0x00000000002A2000-memory.dmpFilesize
520KB
-
memory/1016-55-0x0000000004250000-0x0000000004286000-memory.dmpFilesize
216KB
-
memory/1016-62-0x00000000008C0000-0x00000000008C3000-memory.dmpFilesize
12KB
-
memory/1032-68-0x0000000000000000-mapping.dmp
-
memory/1036-60-0x0000000000000000-mapping.dmp
-
memory/1176-66-0x000000000040242D-mapping.dmp
-
memory/1176-70-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1392-69-0x0000000000000000-mapping.dmp
-
memory/1688-64-0x0000000000000000-mapping.dmp
-
memory/2012-58-0x000000000040242D-mapping.dmp
-
memory/2012-63-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB