Analysis
-
max time kernel
234s -
max time network
337s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 16:48
Static task
static1
Behavioral task
behavioral1
Sample
42b793620ccc9b361fb627bbc381201a16e55b275446cdd466abedb8c99998b0.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
42b793620ccc9b361fb627bbc381201a16e55b275446cdd466abedb8c99998b0.exe
Resource
win10v2004-20221111-en
General
-
Target
42b793620ccc9b361fb627bbc381201a16e55b275446cdd466abedb8c99998b0.exe
-
Size
3.9MB
-
MD5
0cd38e18027da4fa19ef7e53155b6995
-
SHA1
d620be0f573e9236f4e20cd8d442af39943059e0
-
SHA256
42b793620ccc9b361fb627bbc381201a16e55b275446cdd466abedb8c99998b0
-
SHA512
104c660eca8027b508998d66f925eab992a7e8384eee363b765c36de50beedb12fe2f20ef9784dcb2bcabb98da7163bddbe7f420326447569bedaabfbd5924a6
-
SSDEEP
98304:i0NB93Q53yuQaxlCiHqORcwxDAoHa126mUsj:i0g3wWzHDc8DAoHSmUs
Malware Config
Signatures
-
DarkVNC payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/268-60-0x0000000010000000-0x0000000010089000-memory.dmp darkvnc behavioral1/memory/432-66-0x0000000001C40000-0x0000000001D09000-memory.dmp darkvnc -
Suspicious use of SetThreadContext 1 IoCs
Processes:
42b793620ccc9b361fb627bbc381201a16e55b275446cdd466abedb8c99998b0.exedescription pid process target process PID 268 set thread context of 432 268 42b793620ccc9b361fb627bbc381201a16e55b275446cdd466abedb8c99998b0.exe WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
42b793620ccc9b361fb627bbc381201a16e55b275446cdd466abedb8c99998b0.exepid process 268 42b793620ccc9b361fb627bbc381201a16e55b275446cdd466abedb8c99998b0.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
42b793620ccc9b361fb627bbc381201a16e55b275446cdd466abedb8c99998b0.exepid process 268 42b793620ccc9b361fb627bbc381201a16e55b275446cdd466abedb8c99998b0.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
42b793620ccc9b361fb627bbc381201a16e55b275446cdd466abedb8c99998b0.exedescription pid process target process PID 268 wrote to memory of 432 268 42b793620ccc9b361fb627bbc381201a16e55b275446cdd466abedb8c99998b0.exe WerFault.exe PID 268 wrote to memory of 432 268 42b793620ccc9b361fb627bbc381201a16e55b275446cdd466abedb8c99998b0.exe WerFault.exe PID 268 wrote to memory of 432 268 42b793620ccc9b361fb627bbc381201a16e55b275446cdd466abedb8c99998b0.exe WerFault.exe PID 268 wrote to memory of 432 268 42b793620ccc9b361fb627bbc381201a16e55b275446cdd466abedb8c99998b0.exe WerFault.exe PID 268 wrote to memory of 432 268 42b793620ccc9b361fb627bbc381201a16e55b275446cdd466abedb8c99998b0.exe WerFault.exe PID 268 wrote to memory of 432 268 42b793620ccc9b361fb627bbc381201a16e55b275446cdd466abedb8c99998b0.exe WerFault.exe PID 268 wrote to memory of 432 268 42b793620ccc9b361fb627bbc381201a16e55b275446cdd466abedb8c99998b0.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\42b793620ccc9b361fb627bbc381201a16e55b275446cdd466abedb8c99998b0.exe"C:\Users\Admin\AppData\Local\Temp\42b793620ccc9b361fb627bbc381201a16e55b275446cdd466abedb8c99998b0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/268-54-0x0000000075491000-0x0000000075493000-memory.dmpFilesize
8KB
-
memory/268-55-0x0000000000390000-0x00000000003C2000-memory.dmpFilesize
200KB
-
memory/268-56-0x0000000000400000-0x00000000007F7000-memory.dmpFilesize
4.0MB
-
memory/268-60-0x0000000010000000-0x0000000010089000-memory.dmpFilesize
548KB
-
memory/268-64-0x0000000000400000-0x00000000007F7000-memory.dmpFilesize
4.0MB
-
memory/268-65-0x0000000000400000-0x00000000007F7000-memory.dmpFilesize
4.0MB
-
memory/268-67-0x0000000000400000-0x0000000000448000-memory.dmpFilesize
288KB
-
memory/432-63-0x0000000000000000-mapping.dmp
-
memory/432-66-0x0000000001C40000-0x0000000001D09000-memory.dmpFilesize
804KB