9229bf3c95eefabaf00e4221c0ff71ad3cb8c842a813d8a5816af2b0b15bba06

Analysis

max time kernel
34s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 21:30

Target

夢魔个人远控GHOST+.3.78美化版/Tool/zip/Stubs/lzma.exe
Size

33KB
MD5

ed309dfd7026a539a7dbe3222a45086f
SHA1

523eac449446c5e6724526e197856348305959d7
SHA256

4bc4823e568aa8975aa04fea8a474b105668e19ec4d49f962f6b849e18b4ec03
SHA512

a1db1b8112849151c92181a821bb420283f600faea7bc7b2ec1c976349317fb8e5cf95f64341283d8be30c0e6d583ea7e4ec13bf44663b2b350170b6b1e0ad1f
SSDEEP

768:P4wO7XBz+5Qm3W0tYdrQZHV4EWuWEUOg4jjfS3XJ4ai:wLXB65939tY6HBg4sXJI

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1692 1208 WerFault.exe lzma.exe

pid	pid_target	process	target process
1692	1208	WerFault.exe	lzma.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

lzma.exe

description	pid	process	target process
PID 1208 wrote to memory of 1692	1208	lzma.exe	WerFault.exe
PID 1208 wrote to memory of 1692	1208	lzma.exe	WerFault.exe
PID 1208 wrote to memory of 1692	1208	lzma.exe	WerFault.exe
PID 1208 wrote to memory of 1692	1208	lzma.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\夢魔个人远控GHOST+.3.78美化版\Tool\zip\Stubs\lzma.exe
"C:\Users\Admin\AppData\Local\Temp\夢魔个人远控GHOST+.3.78美化版\Tool\zip\Stubs\lzma.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1208 -s 408
2⤵
- Program crash
PID:1692

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1208-54-0x00000000759C1000-0x00000000759C3000-memory.dmp

Filesize
8KB

Download
memory/1692-55-0x0000000000000000-mapping.dmp

Download