Analysis

  • max time kernel
    74s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    02-06-2022 15:26

General

  • Target

    tmp.exe

  • Size

    310KB

  • MD5

    f920341ef1e2a7c9fb34a0d1c7f2baf2

  • SHA1

    9e280bf23f975e229d2d7cfb3a0a9898cd884d70

  • SHA256

    1d4d968ac653a358c34887f148bd2a44d742252432fbf7000d379c709da1cdb6

  • SHA512

    6725a3a09b4028a0d7b4cf7c7cd1bd9ebec19be993f10a6d916c8f16882d22bf1fc2da0bb635128101429bdb537c5d6922d1368664d9643d6e42235c1b4be856

Malware Config

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4796
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 1996
      2⤵
      • Program crash
      PID:5104
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4796 -ip 4796
    1⤵
      PID:3816

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Credential Access

    Credentials in Files

    2
    T1081

    Discovery

    Query Registry

    1
    T1012

    Collection

    Data from Local System

    2
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4796-130-0x0000000000C89000-0x0000000000CB3000-memory.dmp
      Filesize

      168KB

    • memory/4796-131-0x0000000000BC0000-0x0000000000BF7000-memory.dmp
      Filesize

      220KB

    • memory/4796-132-0x0000000000400000-0x0000000000918000-memory.dmp
      Filesize

      5.1MB

    • memory/4796-133-0x0000000005370000-0x0000000005914000-memory.dmp
      Filesize

      5.6MB

    • memory/4796-134-0x0000000005920000-0x0000000005F38000-memory.dmp
      Filesize

      6.1MB

    • memory/4796-135-0x0000000002D70000-0x0000000002D82000-memory.dmp
      Filesize

      72KB

    • memory/4796-136-0x00000000051D0000-0x00000000052DA000-memory.dmp
      Filesize

      1.0MB

    • memory/4796-137-0x0000000002D90000-0x0000000002DCC000-memory.dmp
      Filesize

      240KB

    • memory/4796-138-0x0000000006D40000-0x0000000006DA6000-memory.dmp
      Filesize

      408KB

    • memory/4796-139-0x0000000007090000-0x0000000007106000-memory.dmp
      Filesize

      472KB

    • memory/4796-140-0x0000000007190000-0x0000000007222000-memory.dmp
      Filesize

      584KB

    • memory/4796-141-0x0000000007370000-0x000000000738E000-memory.dmp
      Filesize

      120KB

    • memory/4796-142-0x00000000077B0000-0x0000000007972000-memory.dmp
      Filesize

      1.8MB

    • memory/4796-143-0x0000000007980000-0x0000000007EAC000-memory.dmp
      Filesize

      5.2MB

    • memory/4796-144-0x0000000000C89000-0x0000000000CB3000-memory.dmp
      Filesize

      168KB

    • memory/4796-145-0x0000000000400000-0x0000000000918000-memory.dmp
      Filesize

      5.1MB