Analysis
-
max time kernel
42s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
30-03-2023 09:52
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
General
-
Target
tmp.exe
-
Size
3.9MB
-
MD5
a8001f151c1ce13aac56097a2bf1f789
-
SHA1
414d9f4219570bc75eb6e6cf2932c4fb407afa56
-
SHA256
7fb411ee3e34e4b79b372b7d2321bf69b46de30c3286edccb7621562caefb60b
-
SHA512
9c20f91c378d9559f6e5115857401def02145bb665a4c64f7842175b077bb6406544caa8197c9713f9b22943ffd87405beb809cf0e684c53b934acfe8d421060
-
SSDEEP
49152:ZHVpQMSWLLKUmQUSgYaNrb5c90DNQdjK/c0kCs:Z1pjSWL5
Malware Config
Signatures
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
tmp.exedescription pid process target process PID 1108 set thread context of 1576 1108 tmp.exe tmp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exetmp.exepid process 768 powershell.exe 1108 tmp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exetmp.exedescription pid process Token: SeDebugPrivilege 768 powershell.exe Token: SeDebugPrivilege 1108 tmp.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
tmp.exedescription pid process target process PID 1108 wrote to memory of 768 1108 tmp.exe powershell.exe PID 1108 wrote to memory of 768 1108 tmp.exe powershell.exe PID 1108 wrote to memory of 768 1108 tmp.exe powershell.exe PID 1108 wrote to memory of 768 1108 tmp.exe powershell.exe PID 1108 wrote to memory of 1000 1108 tmp.exe tmp.exe PID 1108 wrote to memory of 1000 1108 tmp.exe tmp.exe PID 1108 wrote to memory of 1000 1108 tmp.exe tmp.exe PID 1108 wrote to memory of 1000 1108 tmp.exe tmp.exe PID 1108 wrote to memory of 1576 1108 tmp.exe tmp.exe PID 1108 wrote to memory of 1576 1108 tmp.exe tmp.exe PID 1108 wrote to memory of 1576 1108 tmp.exe tmp.exe PID 1108 wrote to memory of 1576 1108 tmp.exe tmp.exe PID 1108 wrote to memory of 1576 1108 tmp.exe tmp.exe PID 1108 wrote to memory of 1576 1108 tmp.exe tmp.exe PID 1108 wrote to memory of 1576 1108 tmp.exe tmp.exe PID 1108 wrote to memory of 1576 1108 tmp.exe tmp.exe PID 1108 wrote to memory of 1576 1108 tmp.exe tmp.exe PID 1108 wrote to memory of 1576 1108 tmp.exe tmp.exe PID 1108 wrote to memory of 1576 1108 tmp.exe tmp.exe PID 1108 wrote to memory of 1576 1108 tmp.exe tmp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\tmp.exeC:\Users\Admin\AppData\Local\Temp\tmp.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp.exeC:\Users\Admin\AppData\Local\Temp\tmp.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/768-60-0x00000000026A0000-0x00000000026E0000-memory.dmpFilesize
256KB
-
memory/768-61-0x00000000026A0000-0x00000000026E0000-memory.dmpFilesize
256KB
-
memory/768-62-0x00000000026A0000-0x00000000026E0000-memory.dmpFilesize
256KB
-
memory/768-63-0x00000000026A0000-0x00000000026E0000-memory.dmpFilesize
256KB
-
memory/768-64-0x00000000026A0000-0x00000000026E0000-memory.dmpFilesize
256KB
-
memory/768-65-0x00000000026A0000-0x00000000026E0000-memory.dmpFilesize
256KB
-
memory/1108-54-0x0000000001090000-0x0000000001474000-memory.dmpFilesize
3.9MB
-
memory/1108-55-0x00000000054E0000-0x0000000005520000-memory.dmpFilesize
256KB
-
memory/1108-56-0x0000000005760000-0x000000000590C000-memory.dmpFilesize
1.7MB
-
memory/1108-57-0x0000000004A50000-0x0000000004AE2000-memory.dmpFilesize
584KB
-
memory/1576-66-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/1576-68-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/1576-67-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/1576-69-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/1576-70-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/1576-74-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/1576-73-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1576-72-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/1576-71-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/1576-76-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/1576-77-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/1576-78-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB