Analysis
-
max time kernel
118s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
18-12-2022 15:15
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20221111-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
tmp.exe
-
Size
652KB
-
MD5
31549917cdc6e3f9d40a48ea5998493f
-
SHA1
c0f7e826645b1ba2ba1fed866992beb9de7a31df
-
SHA256
73f03b369e9df60c2dc97baefcdc4ba920da3a2126c873a4654e1a83510d3b87
-
SHA512
709737c36ef4fe96e99dcac210854a760cbbcff7af428620a0a83f16a5db09af4dbe2b52ccd4cff08fe0d5d4e544ddd9474c7c45005938a32705960c3581dad1
-
SSDEEP
12288:pC6wyk1nvfBP0FQoOd/566f81qjbravk7o3xLWAB8TMfo+aqwFtaif8dHOqPNspj:pC6wp1vfhboOb66Uyavk8hdo+g8BOONu
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/5072-132-0x0000000000400000-0x00000000005AC000-memory.dmp upx behavioral2/memory/5072-134-0x0000000000400000-0x00000000005AC000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 tmp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 tmp.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName tmp.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DOMStorage\msn.com tmp.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\msn.com tmp.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\msn.com\NumberOfSubdomains = "1" tmp.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "45" tmp.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.msn.com tmp.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\msn.com\Total = "45" tmp.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage tmp.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total tmp.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.msn.com\ = "45" tmp.exe -
Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 5072 tmp.exe Token: SeIncBasePriorityPrivilege 5072 tmp.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5072