Overview

overview

10

Static

static

1

tmp.exe

windows7_x64

10

tmp.exe

windows10-2004_x64

8

Analysis

  • max time kernel
    142s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    02-03-2022 16:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    tmp.exe

  • Size

    332KB

  • MD5

    8bc5cae30e499dea0d78f85c309be304

  • SHA1

    95b3af264ecfec7155002f8ee9bbc46c4946e84f

  • SHA256

    ea928c88deed19528dead0fc786936f6ac102f94905ce1bff6df678b7c560726

  • SHA512

    d6149bcc0747f00b53a429dbd1605433830d8f2f67d638eb5e4feb41cb43f5029f42ddeb23c369a5000d5b37896ee51cf6f79cbdc23f0848ce0a10d62901de99

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2884
    • C:\Users\Admin\AppData\Local\Temp\iizlfx.exe
      C:\Users\Admin\AppData\Local\Temp\iizlfx.exe C:\Users\Admin\AppData\Local\Temp\ibfqtjhg
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2136
      • C:\Users\Admin\AppData\Local\Temp\iizlfx.exe
        C:\Users\Admin\AppData\Local\Temp\iizlfx.exe C:\Users\Admin\AppData\Local\Temp\ibfqtjhg
        3⤵
          PID:400
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k wusvcs -p
      1⤵
        PID:2216

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Privilege Escalation

      Defense Evasion

      Credential Access

      Discovery

      System Information Discovery

      1
      T1082

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\fc81nqibepxmw1
        MD5

        296fcc90486bd93b1a6e0593241d1c7f

        SHA1

        34c54d85fe773bf6068752501e16a5c9227d5bee

        SHA256

        2a7dd4eaee410720ffc22a511932a3b1a2b13319f77e0085548d63010e73e18e

        SHA512

        c29c5a7141c84a88db4e890c207a8c5f36987539b68037c82f3256ea6ef6cd679ee643344c0f028cb42c93b4e70ddb965e557dc419be4a06c91752e3157c4464

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\ibfqtjhg
        MD5

        ad17464f77b0864dea1025b4ca517e28

        SHA1

        8c0d2d3aea1c36f8dff24ea2467317ad9773ff68

        SHA256

        a5a41b0b6c1032840a1bc802b29461ef67486a3f36b9d964df10e884ecba825f

        SHA512

        e57a70fc66e2eddba4cf097d97e91fd1de2358be96f89c50a36c155916bcbba2b45f4e02d25819a84780bef2735a9fc4d1682d3b1793f7487668ef293d78c331

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\iizlfx.exe
        MD5

        018adcd630666bff50914157771f6e43

        SHA1

        40e4d330149f8b86766eac860ce3cc06e01f51ac

        SHA256

        039e812b1d3a74c11b8f75424072a59733ef54ffbc1afb33c616966205336f2f

        SHA512

        c2360421eff8f7d5a906690276581e7936f09de0b227b4fed9bda3fc2f261ebb9b5ac5516980bc8ffd60c3d8d3e752a09b246893ebbdd2f46bffddf79971d77f

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\iizlfx.exe
        MD5

        018adcd630666bff50914157771f6e43

        SHA1

        40e4d330149f8b86766eac860ce3cc06e01f51ac

        SHA256

        039e812b1d3a74c11b8f75424072a59733ef54ffbc1afb33c616966205336f2f

        SHA512

        c2360421eff8f7d5a906690276581e7936f09de0b227b4fed9bda3fc2f261ebb9b5ac5516980bc8ffd60c3d8d3e752a09b246893ebbdd2f46bffddf79971d77f

        Download Submit