9229bf3c95eefabaf00e4221c0ff71ad3cb8c842a813d8a5816af2b0b15bba06

Analysis

max time kernel
185s
max time network
225s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 21:30

Target

夢魔个人远控GHOST+.3.78美化版/Tool/zip/Stubs/zlib.exe
Size

35KB
MD5

d05fa54bf1f09272062afe436a912660
SHA1

29938e09ae8e694cd9ea62f9ba1eff4cfb32691e
SHA256

7ed4e5b7e696568f64ada79d7622c7a1a3f5afe656d559442d4ff0aacdba4e07
SHA512

45f8c765bc4b6350a936d19339b23c853a3d12a89ee231dfa5020580089fff49b6b512688bc355bb856088e0dcd4d8d043267f2ce1cccf8915032880fafa043c
SSDEEP

768:mHJd0TpH2+bQ2dUWVX9Hfv1JMWmtLEJOyuBxG0D3mjfS3XJpai:mpgpHzb9dZVX9fHMvG0D3XJl

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2448 1260 WerFault.exe zlib.exe

pid	pid_target	process	target process
2448	1260	WerFault.exe	zlib.exe

C:\Users\Admin\AppData\Local\Temp\夢魔个人远控GHOST+.3.78美化版\Tool\zip\Stubs\zlib.exe
"C:\Users\Admin\AppData\Local\Temp\夢魔个人远控GHOST+.3.78美化版\Tool\zip\Stubs\zlib.exe"
1⤵
PID:1260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 828
2⤵
- Program crash
PID:2448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1260 -ip 1260
1⤵
PID:5056

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact