Analysis
-
max time kernel
143s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
-
submitted
12-04-2023 10:39
General
-
Target
tmp.exe
-
Size
2.7MB
-
MD5
8689848b6fc977ac922e7eb2b1213b4b
-
SHA1
0e768ce6072d32017adf78710643f9548ea055af
-
SHA256
c770b501a97600f4c91198d0c44070053cfd058be75757fc46128f94ce39d5ea
-
SHA512
0487e31576c81449c67a5df6dbb51a108e9c23f644971e49b1fa9934bddcc9252075df65f504db46f3a4e9da5aff8ec216600b5d72f96dbc40462187d80b6d52
-
SSDEEP
49152:z2v/W2v/cWOkZlphYy0WtteeP80doocXjS57T2KeiqesHZAQWwbg14CrjxTDf52g:zeee/rdhd9b3ac6CfpUM4CX9me
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Internet Explorer settings 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
2.7MB
-
Filesize
4.8MB
-
Filesize
624KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
22.5MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB