Overview

overview

7

Static

static

1

tmp.exe

windows7-x64

7

tmp.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    52s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    18-03-2023 10:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    tmp.exe

  • Size

    21.9MB

  • MD5

    4d3da2e3125be80157ffdfe8096aa709

  • SHA1

    acaf836a10533dab9e0ce31e1d0c2da82f9fed70

  • SHA256

    cef6bc73f3b58b2d3205642bb6ccf757768635ba7c3a15e287d0fd2701a888cd

  • SHA512

    5e90a8bdea7a7f76e9fbf02832637d95e16065dfdc5752a544336ceb59b427ac5f4985d201496548540aece2b7c6248cb409d7d5f10e03c479ca58b50cab5ef7

  • SSDEEP

    393216:JyPFMo2cJdmfOEWfzF4T3tOZQGU4pIhs57gU6k3Hy46OaKb6xHsXKr12eiQ+D:Jymo2cGfDWo3x34pFg03S46OgFsFG+D

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 26 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NSIS installer 6 IoCs
    installer
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2008
    • C:\Users\Admin\AppData\Local\Temp\nsyA9D.tmptmp.exe
      "C:\Users\Admin\AppData\Local\Temp\nsyA9D.tmptmp.exe" /productid=5b80e0db-389d-4fda-9337-a60eef60f66a
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:1980

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsy1019.tmp\System.dll
    Filesize

    10KB

    MD5

    56a321bd011112ec5d8a32b2f6fd3231

    SHA1

    df20e3a35a1636de64df5290ae5e4e7572447f78

    SHA256

    bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

    SHA512

    5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsy1019.tmp\ioSpecial.ini
    Filesize

    714B

    MD5

    94ce21dedb6ffa376a2fff35c99c964a

    SHA1

    017eb21c33ea4eb264dacc331c87387008f9fc7c

    SHA256

    d0d2a9498f8e3335642ebf9311d1ccc1e1074a9fd21e4953d39226e62345e1ec

    SHA512

    fccb32d6f832416148c66923f9031414dacf3c053285de96a9619ab668c8cd1b07ae8fde0f3257fdab89c9a5bd973706c7dcd892e6cb4bccc95f002a817e64c8

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsy1019.tmp\processwork.dll
    Filesize

    231KB

    MD5

    0a4fa7a9ba969a805eb0603c7cfe3378

    SHA1

    0f018a8d5b42c6ce8bf34b4a6422861c327af88c

    SHA256

    27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c

    SHA512

    e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsyA9D.tmptmp.exe
    Filesize

    21.9MB

    MD5

    b7ee4a604b69dc03b60899a7e70b6232

    SHA1

    cd93c310a8408ddf01aa9471592fa9e5676b34ec

    SHA256

    a4b581a699f596e5bb670c7d1586b845ee1f6445334fe6024760f5b69048d813

    SHA512

    c2fdabc0c1adeb9b331bb2f9e5de6cacfb83bd1133a5a4fe687b47f52be6ccd38fad4a7b01f36fad7bc1a92f425099821efe33cf9c5ecd8d83358ca95a6bb500

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsyA9D.tmptmp.exe
    Filesize

    21.9MB

    MD5

    b7ee4a604b69dc03b60899a7e70b6232

    SHA1

    cd93c310a8408ddf01aa9471592fa9e5676b34ec

    SHA256

    a4b581a699f596e5bb670c7d1586b845ee1f6445334fe6024760f5b69048d813

    SHA512

    c2fdabc0c1adeb9b331bb2f9e5de6cacfb83bd1133a5a4fe687b47f52be6ccd38fad4a7b01f36fad7bc1a92f425099821efe33cf9c5ecd8d83358ca95a6bb500

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsy1019.tmp\InstallOptions.dll
    Filesize

    14KB

    MD5

    d753362649aecd60ff434adf171a4e7f

    SHA1

    3b752ad064e06e21822c8958ae22e9a6bb8cf3d0

    SHA256

    8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586

    SHA512

    41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsy1019.tmp\System.dll
    Filesize

    10KB

    MD5

    56a321bd011112ec5d8a32b2f6fd3231

    SHA1

    df20e3a35a1636de64df5290ae5e4e7572447f78

    SHA256

    bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

    SHA512

    5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsy1019.tmp\System.dll
    Filesize

    10KB

    MD5

    56a321bd011112ec5d8a32b2f6fd3231

    SHA1

    df20e3a35a1636de64df5290ae5e4e7572447f78

    SHA256

    bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

    SHA512

    5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsy1019.tmp\UAC.dll
    Filesize

    17KB

    MD5

    88ad3fd90fc52ac3ee0441a38400a384

    SHA1

    08bc9e1f5951b54126b5c3c769e3eaed42f3d10b

    SHA256

    e58884695378cf02715373928bb8ade270baf03144369463f505c3b3808cbc42

    SHA512

    359496f571e6fa2ec4c5ab5bd1d35d1330586f624228713ae55c65a69e07d8623022ef54337c22c3aab558a9b74d9977c8436f5fea4194899d9ef3ffd74e7dbb

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsy1019.tmp\nsArray.dll
    Filesize

    12KB

    MD5

    0917ee492308b691326e6581e8c793c9

    SHA1

    ff689c8051ffca7657461ac828bc46e303ab8e59

    SHA256

    81745087f193b6fa131189f4b3ee9caa93e9692e408d3955fbcb9a4ec8516e2f

    SHA512

    2a4ae4b93b0eac113a0e65f459798466120f1af4605a82a11f9022d790fe0b4f7d368b312f8a073b1dcfe8760e529ea56a5b5d4289321dc9f2fc8a22691b42b5

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsy1019.tmp\processwork.dll
    Filesize

    231KB

    MD5

    0a4fa7a9ba969a805eb0603c7cfe3378

    SHA1

    0f018a8d5b42c6ce8bf34b4a6422861c327af88c

    SHA256

    27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c

    SHA512

    e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsy1019.tmp\processwork.dll
    Filesize

    231KB

    MD5

    0a4fa7a9ba969a805eb0603c7cfe3378

    SHA1

    0f018a8d5b42c6ce8bf34b4a6422861c327af88c

    SHA256

    27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c

    SHA512

    e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsy1019.tmp\processwork.dll
    Filesize

    231KB

    MD5

    0a4fa7a9ba969a805eb0603c7cfe3378

    SHA1

    0f018a8d5b42c6ce8bf34b4a6422861c327af88c

    SHA256

    27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c

    SHA512

    e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsy1019.tmp\processwork.dll
    Filesize

    231KB

    MD5

    0a4fa7a9ba969a805eb0603c7cfe3378

    SHA1

    0f018a8d5b42c6ce8bf34b4a6422861c327af88c

    SHA256

    27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c

    SHA512

    e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsy1019.tmp\processwork.dll
    Filesize

    231KB

    MD5

    0a4fa7a9ba969a805eb0603c7cfe3378

    SHA1

    0f018a8d5b42c6ce8bf34b4a6422861c327af88c

    SHA256

    27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c

    SHA512

    e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsy1019.tmp\processwork.dll
    Filesize

    231KB

    MD5

    0a4fa7a9ba969a805eb0603c7cfe3378

    SHA1

    0f018a8d5b42c6ce8bf34b4a6422861c327af88c

    SHA256

    27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c

    SHA512

    e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsy1019.tmp\processwork.dll
    Filesize

    231KB

    MD5

    0a4fa7a9ba969a805eb0603c7cfe3378

    SHA1

    0f018a8d5b42c6ce8bf34b4a6422861c327af88c

    SHA256

    27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c

    SHA512

    e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsy1019.tmp\processwork.dll
    Filesize

    231KB

    MD5

    0a4fa7a9ba969a805eb0603c7cfe3378

    SHA1

    0f018a8d5b42c6ce8bf34b4a6422861c327af88c

    SHA256

    27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c

    SHA512

    e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsy1019.tmp\processwork.dll
    Filesize

    231KB

    MD5

    0a4fa7a9ba969a805eb0603c7cfe3378

    SHA1

    0f018a8d5b42c6ce8bf34b4a6422861c327af88c

    SHA256

    27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c

    SHA512

    e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsy1019.tmp\processwork.dll
    Filesize

    231KB

    MD5

    0a4fa7a9ba969a805eb0603c7cfe3378

    SHA1

    0f018a8d5b42c6ce8bf34b4a6422861c327af88c

    SHA256

    27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c

    SHA512

    e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsy1019.tmp\processwork.dll
    Filesize

    231KB

    MD5

    0a4fa7a9ba969a805eb0603c7cfe3378

    SHA1

    0f018a8d5b42c6ce8bf34b4a6422861c327af88c

    SHA256

    27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c

    SHA512

    e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsy1019.tmp\processwork.dll
    Filesize

    231KB

    MD5

    0a4fa7a9ba969a805eb0603c7cfe3378

    SHA1

    0f018a8d5b42c6ce8bf34b4a6422861c327af88c

    SHA256

    27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c

    SHA512

    e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsy1019.tmp\processwork.dll
    Filesize

    231KB

    MD5

    0a4fa7a9ba969a805eb0603c7cfe3378

    SHA1

    0f018a8d5b42c6ce8bf34b4a6422861c327af88c

    SHA256

    27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c

    SHA512

    e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsy1019.tmp\processwork.dll
    Filesize

    231KB

    MD5

    0a4fa7a9ba969a805eb0603c7cfe3378

    SHA1

    0f018a8d5b42c6ce8bf34b4a6422861c327af88c

    SHA256

    27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c

    SHA512

    e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsy1019.tmp\processwork.dll
    Filesize

    231KB

    MD5

    0a4fa7a9ba969a805eb0603c7cfe3378

    SHA1

    0f018a8d5b42c6ce8bf34b4a6422861c327af88c

    SHA256

    27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c

    SHA512

    e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsy1019.tmp\processwork.dll
    Filesize

    231KB

    MD5

    0a4fa7a9ba969a805eb0603c7cfe3378

    SHA1

    0f018a8d5b42c6ce8bf34b4a6422861c327af88c

    SHA256

    27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c

    SHA512

    e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsy1019.tmp\processwork.dll
    Filesize

    231KB

    MD5

    0a4fa7a9ba969a805eb0603c7cfe3378

    SHA1

    0f018a8d5b42c6ce8bf34b4a6422861c327af88c

    SHA256

    27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c

    SHA512

    e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsy1019.tmp\processwork.dll
    Filesize

    231KB

    MD5

    0a4fa7a9ba969a805eb0603c7cfe3378

    SHA1

    0f018a8d5b42c6ce8bf34b4a6422861c327af88c

    SHA256

    27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c

    SHA512

    e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsy1019.tmp\processwork.dll
    Filesize

    231KB

    MD5

    0a4fa7a9ba969a805eb0603c7cfe3378

    SHA1

    0f018a8d5b42c6ce8bf34b4a6422861c327af88c

    SHA256

    27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c

    SHA512

    e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsy1019.tmp\processwork.dll
    Filesize

    231KB

    MD5

    0a4fa7a9ba969a805eb0603c7cfe3378

    SHA1

    0f018a8d5b42c6ce8bf34b4a6422861c327af88c

    SHA256

    27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c

    SHA512

    e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsyA9D.tmptmp.exe
    Filesize

    21.9MB

    MD5

    b7ee4a604b69dc03b60899a7e70b6232

    SHA1

    cd93c310a8408ddf01aa9471592fa9e5676b34ec

    SHA256

    a4b581a699f596e5bb670c7d1586b845ee1f6445334fe6024760f5b69048d813

    SHA512

    c2fdabc0c1adeb9b331bb2f9e5de6cacfb83bd1133a5a4fe687b47f52be6ccd38fad4a7b01f36fad7bc1a92f425099821efe33cf9c5ecd8d83358ca95a6bb500

    Download Submit

  • memory/1980-84-0x00000000004B0000-0x00000000004F1000-memory.dmp

    Filesize

    260KB

    Download