Analysis

  • max time kernel
    50s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2022, 14:01

General

  • Target

    tmp.exe

  • Size

    5.5MB

  • MD5

    769c88af8f79b502a3f372313da5c304

  • SHA1

    1ca8f93fae77bebfa4d44d09d7150c62b2937d88

  • SHA256

    ba2b024ed0ca0fc1ff7c4637e16eb5438ef7f7ca983142accdb501c12f048a63

  • SHA512

    5ee6d5bddde129b816f1924d66ebaf0651321b198103b779679dfc12f897798764905a9baa0b185b5c1133655935c559a4822acfe126e1a8306f17db48a7d071

  • SSDEEP

    98304:uPEw5ltGUK8dHjjg2XhQGp74t55m4Si88Gv6DvbSwS4uo:u8eGk4AQQUFm5i8BSDG4L

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4148

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4148-132-0x0000000000400000-0x0000000000C40000-memory.dmp

    Filesize

    8.2MB

  • memory/4148-133-0x0000000077B30000-0x0000000077CD3000-memory.dmp

    Filesize

    1.6MB

  • memory/4148-134-0x0000000077350000-0x0000000077565000-memory.dmp

    Filesize

    2.1MB

  • memory/4148-136-0x0000000077880000-0x0000000077A20000-memory.dmp

    Filesize

    1.6MB

  • memory/4148-137-0x0000000075C80000-0x0000000075CFA000-memory.dmp

    Filesize

    488KB

  • memory/4148-1480-0x0000000000400000-0x0000000000C40000-memory.dmp

    Filesize

    8.2MB

  • memory/4148-1481-0x0000000000400000-0x0000000000C40000-memory.dmp

    Filesize

    8.2MB

  • memory/4148-1482-0x0000000000400000-0x0000000000C40000-memory.dmp

    Filesize

    8.2MB

  • memory/4148-1483-0x0000000000400000-0x0000000000C40000-memory.dmp

    Filesize

    8.2MB

  • memory/4148-1485-0x0000000000400000-0x0000000000C40000-memory.dmp

    Filesize

    8.2MB

  • memory/4148-1486-0x0000000010000000-0x0000000010041000-memory.dmp

    Filesize

    260KB

  • memory/4148-1490-0x0000000000400000-0x0000000000C40000-memory.dmp

    Filesize

    8.2MB

  • memory/4148-1491-0x0000000002DE0000-0x0000000002EE0000-memory.dmp

    Filesize

    1024KB

  • memory/4148-1492-0x0000000000400000-0x0000000000C40000-memory.dmp

    Filesize

    8.2MB