Analysis
- max time kernel
27s - max time network
30s - platform
windows7_x64 - resource
win7-20221111-en - resource tags
- submitted
07/01/2023, 04:18
General
- Target file.exe
- Size 829KB
- Sample230107-ewyl8acf84
- SHA256 9ba9960dcd12bb6f11891dfef5f70269743a95f656b2c7b161fc36ba708c4dcb
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "VANOZ" /tr "C:\ProgramData\Explorer\VANOZ.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "VANOZ" /tr "C:\ProgramData\Explorer\VANOZ.exe"3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1148 -s 12002⤵
- Program crash
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1148-73-0x000007FEFC4F0000-0x000007FEFC512000-memory.dmp
memory/1148-70-0x000007FEFB3D0000-0x000007FEFB426000-memory.dmp
memory/1148-59-0x000007FEFD8F0000-0x000007FEFD98F000-memory.dmp
memory/1148-60-0x0000000076C40000-0x0000000076D5F000-memory.dmp
memory/1148-61-0x000007FEFCE50000-0x000007FEFCEBC000-memory.dmp
memory/1148-62-0x000007FEFE9E0000-0x000007FEFEA51000-memory.dmp
memory/1148-63-0x000007FEF6350000-0x000007FEF6447000-memory.dmp
memory/1148-64-0x000007FEFEAB0000-0x000007FEFEB8B000-memory.dmp
memory/1148-65-0x000007FEF53D0000-0x000007FEF5DBC000-memory.dmp
memory/1148-66-0x0000000001170000-0x00000000012AA000-memory.dmp
memory/1148-67-0x00000000004E0000-0x0000000000523000-memory.dmp
memory/1148-68-0x000007FEFD2A0000-0x000007FEFD3CD000-memory.dmp
memory/1148-69-0x000007FEFD3D0000-0x000007FEFD5D3000-memory.dmp
memory/1148-88-0x0000000001170000-0x00000000012AA000-memory.dmp
memory/1148-71-0x0000000001170000-0x00000000012AA000-memory.dmp
memory/1148-72-0x000007FEF60E0000-0x000007FEF620C000-memory.dmp
memory/1148-58-0x0000000076B40000-0x0000000076C3A000-memory.dmp
memory/1148-55-0x000007FEF6930000-0x000007FEF699F000-memory.dmp
memory/1148-84-0x000007FEFD990000-0x000007FEFD9AF000-memory.dmp
memory/1148-76-0x000007FEFD120000-0x000007FEFD1F7000-memory.dmp
memory/1148-57-0x000007FEFE970000-0x000007FEFE9D7000-memory.dmp
memory/1148-56-0x000007FEF6450000-0x000007FEF64EC000-memory.dmp
memory/1148-91-0x000007FEF15B0000-0x000007FEF16E8000-memory.dmp
memory/1148-90-0x000007FEFC3A0000-0x000007FEFC3B7000-memory.dmp
memory/1148-80-0x000007FEFB130000-0x000007FEFB345000-memory.dmp
memory/1148-89-0x00000000004E0000-0x0000000000523000-memory.dmp
memory/1496-86-0x0000000002414000-0x0000000002417000-memory.dmp
memory/1496-87-0x000000000241B000-0x000000000243A000-memory.dmp
memory/1496-85-0x000000001B770000-0x000000001BA6F000-memory.dmp
memory/1496-82-0x000007FEEC1B0000-0x000007FEECD0D000-memory.dmp
memory/1496-83-0x0000000002414000-0x0000000002417000-memory.dmp
memory/1496-77-0x000007FEECD10000-0x000007FEED733000-memory.dmp
memory/1496-75-0x000007FEFB5B1000-0x000007FEFB5B3000-memory.dmp