Analysis
-
max time kernel
51s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19-02-2023 13:36
Static task
static1
Behavioral task
behavioral1
Sample
Davinci Resolve 18/Davinci Resolve 18.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Davinci Resolve 18/Davinci Resolve 18.exe
Resource
win10v2004-20220812-en
General
-
Target
Davinci Resolve 18/Davinci Resolve 18.exe
-
Size
743.9MB
-
MD5
2d00e9d780a63485e6e39a13c2587c97
-
SHA1
4c6e8b91483eef6cb46203c0581c6a4cb1c73e04
-
SHA256
4fe3477b8a21bb7aa836f21edf5f7ee0d8996f9f4365817ff87bed6262d9b8fc
-
SHA512
d6d514f5992b2dc098f2374975ba0185034c873962eee495141fa9bb1e0b0e5f4d4ec3493c64cc023a32be0e54c501002d0ce492b220aabef9e5d6bb2ed034c1
-
SSDEEP
24576:t1dH+Ai6F0VDCUvKckwGMIXACwVM72/MpqG4yPa:tPHrHWVmtckw8GMjq
Malware Config
Extracted
raccoon
00ff523bf171da1ebed0d640e0c65073
http://77.73.133.23/
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Davinci Resolve 18.exedescription pid process target process PID 848 set thread context of 900 848 Davinci Resolve 18.exe Davinci Resolve 18.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 936 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 936 powershell.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Davinci Resolve 18.exedescription pid process target process PID 848 wrote to memory of 936 848 Davinci Resolve 18.exe powershell.exe PID 848 wrote to memory of 936 848 Davinci Resolve 18.exe powershell.exe PID 848 wrote to memory of 936 848 Davinci Resolve 18.exe powershell.exe PID 848 wrote to memory of 936 848 Davinci Resolve 18.exe powershell.exe PID 848 wrote to memory of 900 848 Davinci Resolve 18.exe Davinci Resolve 18.exe PID 848 wrote to memory of 900 848 Davinci Resolve 18.exe Davinci Resolve 18.exe PID 848 wrote to memory of 900 848 Davinci Resolve 18.exe Davinci Resolve 18.exe PID 848 wrote to memory of 900 848 Davinci Resolve 18.exe Davinci Resolve 18.exe PID 848 wrote to memory of 900 848 Davinci Resolve 18.exe Davinci Resolve 18.exe PID 848 wrote to memory of 900 848 Davinci Resolve 18.exe Davinci Resolve 18.exe PID 848 wrote to memory of 900 848 Davinci Resolve 18.exe Davinci Resolve 18.exe PID 848 wrote to memory of 900 848 Davinci Resolve 18.exe Davinci Resolve 18.exe PID 848 wrote to memory of 900 848 Davinci Resolve 18.exe Davinci Resolve 18.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Davinci Resolve 18\Davinci Resolve 18.exe"C:\Users\Admin\AppData\Local\Temp\Davinci Resolve 18\Davinci Resolve 18.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Davinci Resolve 18\Davinci Resolve 18.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Davinci Resolve 18\Davinci Resolve 18.exe"C:\Users\Admin\AppData\Local\Temp\Davinci Resolve 18\Davinci Resolve 18.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/848-60-0x00000000043A0000-0x00000000043C0000-memory.dmpFilesize
128KB
-
memory/848-55-0x0000000075041000-0x0000000075043000-memory.dmpFilesize
8KB
-
memory/848-56-0x0000000000430000-0x0000000000444000-memory.dmpFilesize
80KB
-
memory/848-57-0x0000000000450000-0x000000000045A000-memory.dmpFilesize
40KB
-
memory/848-58-0x0000000004FE0000-0x000000000503C000-memory.dmpFilesize
368KB
-
memory/848-54-0x0000000000BD0000-0x0000000000C94000-memory.dmpFilesize
784KB
-
memory/900-63-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/900-62-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/900-65-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/900-67-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/900-68-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/900-69-0x00000000004088ED-mapping.dmp
-
memory/936-59-0x0000000000000000-mapping.dmp
-
memory/936-71-0x0000000074550000-0x0000000074AFB000-memory.dmpFilesize
5.7MB
-
memory/936-72-0x0000000074550000-0x0000000074AFB000-memory.dmpFilesize
5.7MB