Overview

overview

10

Static

static

tmp.exe

windows7-x64

10

tmp.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    tmp

  • Size

    2.1MB

  • Sample

    220922-fag8sadfcn

  • MD5

    4447b87355a03b351c70b71f90fc8f0d

  • SHA1

    52da8c186ea59a5d304a89df9df7a26ba23a6187

  • SHA256

    6e73de3806a1871763401908a336249ea3afc8e3ad52d468a1240d7f7afd46ed

  • SHA512

    3124d1f6151b17caf12c6ce1edd35b9d02134d68305ebb00ef30dfd29a06a77df36a18e4123f2f9f4abc0fe947b537074214995a2c10cd9e1f9889d841b2e200

  • SSDEEP

    49152:H4DHtPgAL3tKR3elqx0R0jch87ynsHc0UIrdC6LZ:Yzao3tU3JvchcWf0JC61

Score
10/10
persistence

Malware Config

Targets

    • Target

      tmp

    • Size

      2.1MB

    • MD5

      4447b87355a03b351c70b71f90fc8f0d

    • SHA1

      52da8c186ea59a5d304a89df9df7a26ba23a6187

    • SHA256

      6e73de3806a1871763401908a336249ea3afc8e3ad52d468a1240d7f7afd46ed

    • SHA512

      3124d1f6151b17caf12c6ce1edd35b9d02134d68305ebb00ef30dfd29a06a77df36a18e4123f2f9f4abc0fe947b537074214995a2c10cd9e1f9889d841b2e200

    • SSDEEP

      49152:H4DHtPgAL3tKR3elqx0R0jch87ynsHc0UIrdC6LZ:Yzao3tU3JvchcWf0JC61

    Score
    10/10
    persistence

    • Modifies WinLogon for persistence

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks