Analysis

  • max time kernel
    4294180s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20220223-en
  • submitted
    28-02-2022 05:06

General

  • Target

    tmp.exe

  • Size

    652KB

  • MD5

    5dfc3eefe1c51312d0020910020c4025

  • SHA1

    8e6ab92a5d138b3f997ee0a12bb2438e82236760

  • SHA256

    7cff549b9b283c2124a963526762625ac3a476ced39bab1afb2cf1accd3249d0

  • SHA512

    6be0d92564a380dff41d2960d32e17fe81c0340dbb09a1207a109fa0f584a75e066bbc3a26f5d53f4a62037fd09938a3729d2f595100c7b26bacea38e5e4a6cd

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Modifies Internet Explorer settings
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1940

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1940-54-0x0000000076A01000-0x0000000076A03000-memory.dmp

    Filesize

    8KB

  • memory/1940-56-0x000000000937D000-0x000000000937E000-memory.dmp

    Filesize

    4KB

  • memory/1940-57-0x0000000009385000-0x0000000009386000-memory.dmp

    Filesize

    4KB

  • memory/1940-55-0x00000000065B4000-0x00000000065B5000-memory.dmp

    Filesize

    4KB

  • memory/1940-65-0x000000000BDD3000-0x000000000BDD4000-memory.dmp

    Filesize

    4KB

  • memory/1940-64-0x000000000BDD4000-0x000000000BDD5000-memory.dmp

    Filesize

    4KB

  • memory/1940-63-0x000000000ACD5000-0x000000000ACD6000-memory.dmp

    Filesize

    4KB

  • memory/1940-66-0x000000000BDDF000-0x000000000BDE0000-memory.dmp

    Filesize

    4KB

  • memory/1940-62-0x000000000ACD1000-0x000000000ACD2000-memory.dmp

    Filesize

    4KB

  • memory/1940-61-0x000000000ACCD000-0x000000000ACCE000-memory.dmp

    Filesize

    4KB

  • memory/1940-60-0x000000000ACCB000-0x000000000ACCC000-memory.dmp

    Filesize

    4KB

  • memory/1940-59-0x000000000ACCC000-0x000000000ACCD000-memory.dmp

    Filesize

    4KB

  • memory/1940-58-0x000000000ACC2000-0x000000000ACC3000-memory.dmp

    Filesize

    4KB