Analysis
-
max time kernel
163s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
16-04-2023 11:04
General
-
Target
tmp.exe
-
Size
3.0MB
-
MD5
575f0a5d9e2f34752d16004724e490b7
-
SHA1
48af1d5f46ffddbceb2c626bcd0417840a2ca8d4
-
SHA256
93e25d10a02c8c0c68d23c7887aa83cfd4de428f52583787f9f829cc22f08159
-
SHA512
19771087ed80e8b613ea647457a7d4186748aad28a587e654250b2479c658633f56f417ff8a6e048db77d21b57502102cee6554cc8ac297afaaa29101f2a04da
-
SSDEEP
49152:1NMhE2sHLkzhdM3bA5h/r9p5cSFIPdrdFIKs5IzCegTHYjr+Rln2vyprCUjaBNc:WM0t9p5pM1s2ibYX+Rl2Du
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 37 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.5MB
-
Filesize
2.1MB
-
Filesize
1.6MB
-
Filesize
488KB
-
Filesize
4.5MB
-
Filesize
4.5MB
-
Filesize
4.5MB
-
Filesize
144KB
-
Filesize
4.5MB
-
Filesize
1024KB
-
Filesize
1024KB