Analysis
-
max time kernel
51s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
07/06/2023, 11:11
General
-
Target
tmp.exe
-
Size
5.3MB
-
MD5
cb77eac7737661d48dfedbccd07e0d95
-
SHA1
ddb0c70e122a5970b76ab3e62aafa601a8326f51
-
SHA256
74d63f658c7d76570d226e2f5535ebe18b33fa1696653ce520810c14511b0266
-
SHA512
79cc356fc099a5c8b317bd2ff8e9e7703e49e6a873cafdf7fef8bef0169d4250686f4ec93b71b873a9682424225ef5e291585e444b663e2390511a498183c588
-
SSDEEP
98304:fZjbxmUu9NHQZKgVpQhRsuQOfAssiYD5XrEmZ5GMreeb8KJqfNLq6VqGjGt:RjbxfXZKJhlQhJiYrP5NiebsNBVqGS
Malware Config
Signatures
-
VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 38 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
300KB
MD5a40a214db11296040db96cdfd3969e08
SHA1f79b6b66ba9366f2e3b4bdef53191e79c122f5bb
SHA256185c9786657c6d08c7e4eb259f5ead74093b1d9191758a51203c528cf5a9fa2d
SHA51290500ad6b261335dc70a78b6efa2ad4016a299b5d9aad582e28f306098b7b03d6b2e02b26baab9fd417bf20517147e715a65393089b168c6e27c8053d927ea92
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
9.2MB
-
Filesize
304KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB