Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
24-07-2022 19:41
Behavioral task
behavioral1
Sample
4d041cb67dd05b71c2da8c2b85ab6972e7fd097f3268295f4679480273bf1647.exe
Resource
win7-20220718-en
windows7-x64
8 signatures
150 seconds
General
-
Target
4d041cb67dd05b71c2da8c2b85ab6972e7fd097f3268295f4679480273bf1647.exe
-
Size
104KB
-
MD5
1934fa4786eaf1339b4f808154f3f9c3
-
SHA1
eccfb04816095ae59d196295b9713773717a65cc
-
SHA256
4d041cb67dd05b71c2da8c2b85ab6972e7fd097f3268295f4679480273bf1647
-
SHA512
47e99dfae7deb0a5310c8cdcb28c744b6a7c02f5d72167904b85506bb7c62ce8b7daa5ad68dfdf5e64ea58867a3358ed72f45035ecbc97a53d9bb0a289a6eafa
Malware Config
Signatures
-
Drops file in System32 directory 10 IoCs
Processes:
viewerdma.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 viewerdma.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE viewerdma.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content viewerdma.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 viewerdma.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies viewerdma.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 viewerdma.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft viewerdma.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache viewerdma.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData viewerdma.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 viewerdma.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 9 IoCs
Processes:
viewerdma.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix viewerdma.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" viewerdma.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" viewerdma.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" viewerdma.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing viewerdma.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ viewerdma.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" viewerdma.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" viewerdma.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" viewerdma.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
viewerdma.exepid process 1676 viewerdma.exe 1676 viewerdma.exe 1676 viewerdma.exe 1676 viewerdma.exe 1676 viewerdma.exe 1676 viewerdma.exe 1676 viewerdma.exe 1676 viewerdma.exe 1676 viewerdma.exe 1676 viewerdma.exe 1676 viewerdma.exe 1676 viewerdma.exe 1676 viewerdma.exe 1676 viewerdma.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
4d041cb67dd05b71c2da8c2b85ab6972e7fd097f3268295f4679480273bf1647.exepid process 612 4d041cb67dd05b71c2da8c2b85ab6972e7fd097f3268295f4679480273bf1647.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
4d041cb67dd05b71c2da8c2b85ab6972e7fd097f3268295f4679480273bf1647.exeviewerdma.exedescription pid process target process PID 4180 wrote to memory of 612 4180 4d041cb67dd05b71c2da8c2b85ab6972e7fd097f3268295f4679480273bf1647.exe 4d041cb67dd05b71c2da8c2b85ab6972e7fd097f3268295f4679480273bf1647.exe PID 4180 wrote to memory of 612 4180 4d041cb67dd05b71c2da8c2b85ab6972e7fd097f3268295f4679480273bf1647.exe 4d041cb67dd05b71c2da8c2b85ab6972e7fd097f3268295f4679480273bf1647.exe PID 4180 wrote to memory of 612 4180 4d041cb67dd05b71c2da8c2b85ab6972e7fd097f3268295f4679480273bf1647.exe 4d041cb67dd05b71c2da8c2b85ab6972e7fd097f3268295f4679480273bf1647.exe PID 4968 wrote to memory of 1676 4968 viewerdma.exe viewerdma.exe PID 4968 wrote to memory of 1676 4968 viewerdma.exe viewerdma.exe PID 4968 wrote to memory of 1676 4968 viewerdma.exe viewerdma.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d041cb67dd05b71c2da8c2b85ab6972e7fd097f3268295f4679480273bf1647.exe"C:\Users\Admin\AppData\Local\Temp\4d041cb67dd05b71c2da8c2b85ab6972e7fd097f3268295f4679480273bf1647.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4d041cb67dd05b71c2da8c2b85ab6972e7fd097f3268295f4679480273bf1647.exe--86a46e142⤵
- Suspicious behavior: RenamesItself
-
C:\Windows\SysWOW64\viewerdma.exe"C:\Windows\SysWOW64\viewerdma.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\viewerdma.exe--fa0942bc2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/612-131-0x0000000000000000-mapping.dmp
-
memory/612-133-0x0000000002020000-0x0000000002031000-memory.dmpFilesize
68KB
-
memory/612-134-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/612-138-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1676-136-0x0000000000000000-mapping.dmp
-
memory/1676-139-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/1676-140-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/4180-130-0x0000000000580000-0x00000000005FA000-memory.dmpFilesize
488KB
-
memory/4180-132-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4968-135-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/4968-137-0x0000000000580000-0x0000000000591000-memory.dmpFilesize
68KB