Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
14-01-2023 15:37
General
-
Target
tmp.exe
-
Size
29.4MB
-
MD5
8ef684ee2f0d30041d4a089f92f4ab06
-
SHA1
573aaabccc069703bdf9fab9fd31168303495225
-
SHA256
1620726a24a49b48d5cc9aa9a26ff4bbe849a4a583031fb8155ec216ddd591a5
-
SHA512
7a429a21b11f4e9d77e22ed9ae25a7b2f09621edc74b19a6e06849df44e5458477d7510e4ef438e2f674bace8d334777dde4823b8006e09f6849944a768e280d
-
SSDEEP
786432:zlB8NEuBnbj8cJRPVCZGc7Iv5aMMu8lM9mLAsJpUIL7Rl:JBMkTwc7yaMRR9mnJdL7n
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
VMProtect packed file 8 IoCs
Detects executables packed with VMProtect commercial packer.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\»ðÁú´«Ëµ\tmp.exeC:\»ðÁú´«Ëµ\tmp.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41B
MD5fa4a6393f371a289f6b187ba6aaada19
SHA184f4f1eedd713c86f97605f7e8a23a1f2d2678a3
SHA25653ea98bb79bd329140803195f5c46b117986bdeba86f301f9613de657f38b528
SHA5122c6d8429aa7bfb9b2357c3ef710a5d98cd1cb62f29ba36091ddf4a05fe28cc7b35a4609aa7cd1e1f59350c004e2ab9f1c18cc2506bde92f64d6fa3413e0a0519
-
Filesize
11B
MD50ad0059a41e8461c75592d5d2a09b822
SHA1a4626fc3ffe3756258b418b2d72e37dbbad356d5
SHA2563ee3395d306de139ad06ee9b185b77e60b4203e320ee96799e94746f942de25c
SHA512707b076e11ba1ef56f5c45708d8e0eef39c6d5a7a3558da0b2b7f441616a63fb9a9d911084c97c17f88410f7b2445e1494a1b89f2a88806c940e8da49ed7c817
-
Filesize
29.4MB
MD58ef684ee2f0d30041d4a089f92f4ab06
SHA1573aaabccc069703bdf9fab9fd31168303495225
SHA2561620726a24a49b48d5cc9aa9a26ff4bbe849a4a583031fb8155ec216ddd591a5
SHA5127a429a21b11f4e9d77e22ed9ae25a7b2f09621edc74b19a6e06849df44e5458477d7510e4ef438e2f674bace8d334777dde4823b8006e09f6849944a768e280d
-
Filesize
29.4MB
MD58ef684ee2f0d30041d4a089f92f4ab06
SHA1573aaabccc069703bdf9fab9fd31168303495225
SHA2561620726a24a49b48d5cc9aa9a26ff4bbe849a4a583031fb8155ec216ddd591a5
SHA5127a429a21b11f4e9d77e22ed9ae25a7b2f09621edc74b19a6e06849df44e5458477d7510e4ef438e2f674bace8d334777dde4823b8006e09f6849944a768e280d
-
Filesize
15.9MB
-
Filesize
15.9MB
-
Filesize
15.9MB
-
Filesize
15.9MB
-
Filesize
15.9MB
-
Filesize
15.9MB