Analysis
-
max time kernel
91s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
22-05-2022 09:49
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
tmp.exe
-
Size
1.3MB
-
MD5
756e9a919f3263313d2aa615fa2c4e07
-
SHA1
ab4587aaeebe307416adf32ca542d4ee61465ca1
-
SHA256
c6f683d875c4d7b463750391aa68524d517400900da8317069de4f7ac6a703b0
-
SHA512
3a3896b833bdcb084a1a0c0d9777ebb0b7cd34fe6b89ef1c17f37ace011b26e972d4132edc1b48f91abbc3d3892db4616fd788f8434b0ffa921ceb4664bd4881
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
tmp.exedescription ioc process File opened (read-only) \??\q: tmp.exe File opened (read-only) \??\u: tmp.exe File opened (read-only) \??\f: tmp.exe File opened (read-only) \??\l: tmp.exe File opened (read-only) \??\n: tmp.exe File opened (read-only) \??\p: tmp.exe File opened (read-only) \??\s: tmp.exe File opened (read-only) \??\t: tmp.exe File opened (read-only) \??\v: tmp.exe File opened (read-only) \??\w: tmp.exe File opened (read-only) \??\x: tmp.exe File opened (read-only) \??\e: tmp.exe File opened (read-only) \??\h: tmp.exe File opened (read-only) \??\i: tmp.exe File opened (read-only) \??\k: tmp.exe File opened (read-only) \??\o: tmp.exe File opened (read-only) \??\r: tmp.exe File opened (read-only) \??\z: tmp.exe File opened (read-only) \??\a: tmp.exe File opened (read-only) \??\b: tmp.exe File opened (read-only) \??\g: tmp.exe File opened (read-only) \??\j: tmp.exe File opened (read-only) \??\m: tmp.exe File opened (read-only) \??\y: tmp.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
tmp.exedescription ioc process File opened for modification \??\PhysicalDrive0 tmp.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
tmp.exepid process 1228 tmp.exe 1228 tmp.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
tmp.exepid process 1228 tmp.exe 1228 tmp.exe