Analysis
-
max time kernel
30s -
max time network
35s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
13-01-2023 11:42
General
-
Target
data/tor/tor.exe
-
Size
3.9MB
-
MD5
52faae579cc30d277fddf60ea4b89e2c
-
SHA1
f2010f4451c7aac3c767a5743370d9252bbbfd7c
-
SHA256
c4ee142394bf7a53e43ca86ab3c03e3712d85c15941588fc4e6e8f5c7a88c654
-
SHA512
3baec48c1718f2252ce788b3832d3adf145f93c3a9e6e6aeabde6d5d5d52bde32c450c46b1385961bf201c30f60570319897f614428414534867af6bf93f16a4
-
SSDEEP
98304:CzZ42i53gAUP71HtcjRkVfQIjiEsgYY9l7:KOaA0HtcjKVfQIb
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
Processes
-
C:\Users\Admin\AppData\Local\Temp\data\tor\tor.exe"C:\Users\Admin\AppData\Local\Temp\data\tor\tor.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4660-132-0x00000000752A0000-0x00000000752C0000-memory.dmpFilesize
128KB
-
memory/4660-133-0x0000000075190000-0x000000007524F000-memory.dmpFilesize
764KB
-
memory/4660-134-0x0000000000700000-0x0000000000AF1000-memory.dmpFilesize
3.9MB
-
memory/4660-135-0x00000000752A0000-0x00000000752C0000-memory.dmpFilesize
128KB
-
memory/4660-136-0x0000000075190000-0x000000007524F000-memory.dmpFilesize
764KB
-
memory/4660-137-0x0000000074C30000-0x0000000074ED3000-memory.dmpFilesize
2.6MB
-
memory/4660-138-0x0000000074EE0000-0x0000000074FA3000-memory.dmpFilesize
780KB
-
memory/4660-139-0x0000000000700000-0x0000000000AF1000-memory.dmpFilesize
3.9MB
-
memory/4660-140-0x0000000000700000-0x0000000000AF1000-memory.dmpFilesize
3.9MB