Analysis
-
max time kernel
4294180s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20220223-en -
submitted
28-02-2022 05:06
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220223-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-en-20220112
General
-
Target
tmp.exe
-
Size
652KB
-
MD5
5dfc3eefe1c51312d0020910020c4025
-
SHA1
8e6ab92a5d138b3f997ee0a12bb2438e82236760
-
SHA256
7cff549b9b283c2124a963526762625ac3a476ced39bab1afb2cf1accd3249d0
-
SHA512
6be0d92564a380dff41d2960d32e17fe81c0340dbb09a1207a109fa0f584a75e066bbc3a26f5d53f4a62037fd09938a3729d2f595100c7b26bacea38e5e4a6cd
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
tmp.exedescription ioc process File opened for modification \??\PhysicalDrive0 tmp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
tmp.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main tmp.exe Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\DOMStorage\msn.com tmp.exe Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\DOMStorage tmp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\DOMStorage\msn.com\NumberOfSubdomains = "1" tmp.exe -
Processes:
tmp.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 tmp.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde tmp.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
tmp.exepid process 1940 tmp.exe 1940 tmp.exe 1940 tmp.exe 1940 tmp.exe 1940 tmp.exe 1940 tmp.exe 1940 tmp.exe 1940 tmp.exe 1940 tmp.exe 1940 tmp.exe 1940 tmp.exe 1940 tmp.exe 1940 tmp.exe 1940 tmp.exe 1940 tmp.exe 1940 tmp.exe 1940 tmp.exe 1940 tmp.exe 1940 tmp.exe 1940 tmp.exe 1940 tmp.exe 1940 tmp.exe 1940 tmp.exe 1940 tmp.exe 1940 tmp.exe 1940 tmp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
tmp.exedescription pid process Token: 33 1940 tmp.exe Token: SeIncBasePriorityPrivilege 1940 tmp.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
tmp.exepid process 1940 tmp.exe 1940 tmp.exe 1940 tmp.exe 1940 tmp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1940