14a3894cd6a6e321d3a07c5b7a2bd22cad174f55feef3b6b6e2279fc5ea66ee8

Analysis

max time kernel
21s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 18:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

远程监控/LZMA/Stubs/zlib.exe
Size

39KB
MD5

7aa7ff7f94ed9375c416a062f264aa03
SHA1

50a9ba6190a2e950ae76a6d230bd9265328ea151
SHA256

a3e1ee3fc049380c7cfcd7607e0f3c3e98a01e30b588473614aadb0ac999419a
SHA512

1eace089a368f7a3a59dfe8e95341f41a3db96c9b06d2d6bb753b5a3d723c0985b007d0d0196ceb90f31da337f20fba45a6fb6a8d1a1871c9c6e94ba656f4cb4
SSDEEP

768:Hc9EFPN+xU+cdRuQi5a1KuzLKSh/5yDgJD6dNBFbPJ/6w9ayai:89EH867i5aZKfDgJq1PJ/6W

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1904 328 WerFault.exe zlib.exe

pid	pid_target	process	target process
1904	328	WerFault.exe	zlib.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

zlib.exe

description	pid	process	target process
PID 328 wrote to memory of 1904	328	zlib.exe	WerFault.exe
PID 328 wrote to memory of 1904	328	zlib.exe	WerFault.exe
PID 328 wrote to memory of 1904	328	zlib.exe	WerFault.exe
PID 328 wrote to memory of 1904	328	zlib.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\远程监控\LZMA\Stubs\zlib.exe
"C:\Users\Admin\AppData\Local\Temp\远程监控\LZMA\Stubs\zlib.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 328 -s 408
2⤵
- Program crash
PID:1904

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/328-54-0x0000000075ED1000-0x0000000075ED3000-memory.dmp

Filesize
8KB

Download
memory/1904-55-0x0000000000000000-mapping.dmp

Download