Analysis

  • max time kernel
    43s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    07-10-2022 18:44

General

  • Target

    tmp.exe

  • Size

    320KB

  • MD5

    79c8aec89b55f0fd893c5358cfe66634

  • SHA1

    cb1065ed12890f9dfa599e94c559626129f9efcb

  • SHA256

    78bd069d6b2a1e617941b71b6953e0a8c792f49d3afbf3663610d60e280048fa

  • SHA512

    8f0080961607b102006594f33904b2e61346c4465874807e411a61d8ac08b3abb186736549161e1ce09910fc3c87f37e1a4052cbb88e8207c9b7b80668fa6ffd

  • SSDEEP

    6144:L2CgfxElP8isat6Z475cw0npnlSLmarpUguiVuVTEryN+9t7NS:L2YR2DEknwaaFUZiVuK7

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:832
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      2⤵
      • Suspicious behavior: AddClipboardFormatListener
      PID:1728

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/832-54-0x00000000013E0000-0x0000000001436000-memory.dmp

    Filesize

    344KB

  • memory/832-55-0x0000000000AC0000-0x0000000000B18000-memory.dmp

    Filesize

    352KB

  • memory/832-56-0x0000000075091000-0x0000000075093000-memory.dmp

    Filesize

    8KB

  • memory/832-57-0x0000000000BE0000-0x0000000000C16000-memory.dmp

    Filesize

    216KB

  • memory/832-58-0x0000000001110000-0x000000000115C000-memory.dmp

    Filesize

    304KB

  • memory/1728-59-0x0000000000400000-0x0000000000436000-memory.dmp

    Filesize

    216KB

  • memory/1728-60-0x0000000000400000-0x0000000000436000-memory.dmp

    Filesize

    216KB

  • memory/1728-62-0x0000000000400000-0x0000000000436000-memory.dmp

    Filesize

    216KB

  • memory/1728-64-0x0000000000400000-0x0000000000436000-memory.dmp

    Filesize

    216KB

  • memory/1728-65-0x0000000000400000-0x0000000000436000-memory.dmp

    Filesize

    216KB

  • memory/1728-70-0x0000000000400000-0x0000000000436000-memory.dmp

    Filesize

    216KB

  • memory/1728-68-0x0000000000400000-0x0000000000436000-memory.dmp

    Filesize

    216KB