Analysis

  • max time kernel
    92s
  • max time network
    119s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-08-2023 18:27

General

  • Target

    tmp.exe

  • Size

    319KB

  • MD5

    2be9bcc8cbd73b5baee5594355a7870d

  • SHA1

    02153a313daaefebd9577d067cd0bd98400bd4fd

  • SHA256

    e4f9c655581551a9238d6eba448ac9b6e36516a4a9ef449e6e7cb21b52c28f55

  • SHA512

    0ea5e70c82c92af983779e2311aa1791b56d76f20d4df72dc966039e4368c54e9668d775ab73b55fb19545bdc37a0b7b640a30e5ffac1768f81247e2b136f023

  • SSDEEP

    6144:iXKLL2S+/qG+pXTJJxTqYQd2ymTPmLii4ed2CO:iXKLqSZG+1TRmYQd2BwZ8

Score
7/10

Malware Config

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2108
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 1752
      2⤵
      • Program crash
      PID:4040
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2108 -ip 2108
    1⤵
      PID:4976

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2108-133-0x00000000034D0000-0x00000000034F9000-memory.dmp

      Filesize

      164KB

    • memory/2108-134-0x0000000003500000-0x000000000353F000-memory.dmp

      Filesize

      252KB

    • memory/2108-135-0x0000000000400000-0x00000000018CD000-memory.dmp

      Filesize

      20.8MB

    • memory/2108-136-0x0000000006010000-0x0000000006020000-memory.dmp

      Filesize

      64KB

    • memory/2108-137-0x00000000742E0000-0x0000000074A90000-memory.dmp

      Filesize

      7.7MB

    • memory/2108-138-0x0000000006010000-0x0000000006020000-memory.dmp

      Filesize

      64KB

    • memory/2108-139-0x0000000006020000-0x00000000065C4000-memory.dmp

      Filesize

      5.6MB

    • memory/2108-140-0x0000000000400000-0x00000000018CD000-memory.dmp

      Filesize

      20.8MB

    • memory/2108-141-0x00000000066D0000-0x0000000006CE8000-memory.dmp

      Filesize

      6.1MB

    • memory/2108-142-0x0000000006CF0000-0x0000000006DFA000-memory.dmp

      Filesize

      1.0MB

    • memory/2108-143-0x0000000005FF0000-0x0000000006002000-memory.dmp

      Filesize

      72KB

    • memory/2108-144-0x0000000006010000-0x0000000006020000-memory.dmp

      Filesize

      64KB

    • memory/2108-145-0x0000000006E00000-0x0000000006E3C000-memory.dmp

      Filesize

      240KB

    • memory/2108-146-0x00000000034D0000-0x00000000034F9000-memory.dmp

      Filesize

      164KB

    • memory/2108-147-0x0000000003500000-0x000000000353F000-memory.dmp

      Filesize

      252KB

    • memory/2108-148-0x00000000742E0000-0x0000000074A90000-memory.dmp

      Filesize

      7.7MB

    • memory/2108-149-0x0000000006010000-0x0000000006020000-memory.dmp

      Filesize

      64KB

    • memory/2108-150-0x0000000007000000-0x0000000007076000-memory.dmp

      Filesize

      472KB

    • memory/2108-151-0x0000000007080000-0x0000000007112000-memory.dmp

      Filesize

      584KB

    • memory/2108-153-0x0000000007120000-0x0000000007186000-memory.dmp

      Filesize

      408KB

    • memory/2108-154-0x0000000007A70000-0x0000000007C32000-memory.dmp

      Filesize

      1.8MB

    • memory/2108-155-0x0000000007C50000-0x000000000817C000-memory.dmp

      Filesize

      5.2MB

    • memory/2108-156-0x00000000083F0000-0x0000000008440000-memory.dmp

      Filesize

      320KB

    • memory/2108-157-0x0000000006010000-0x0000000006020000-memory.dmp

      Filesize

      64KB

    • memory/2108-159-0x0000000000400000-0x00000000018CD000-memory.dmp

      Filesize

      20.8MB

    • memory/2108-160-0x00000000742E0000-0x0000000074A90000-memory.dmp

      Filesize

      7.7MB