Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
06-12-2023 05:06
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20231130-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20231130-en
General
-
Target
tmp.exe
-
Size
93KB
-
MD5
9af8fc91af5e99e4373cbb5713dd40ec
-
SHA1
3ec0d34c5769ec819cb02a2d0bc8f7fde20505c9
-
SHA256
1e7708aaa98da8303b9826e82ed2d0777a5684ecda49071eb91c9d0db4e02172
-
SHA512
fb7bb746f660e024ed78c66ab9f5685e1d28b851dbf5227ddd09e686f13b8f3537c7678b8794e02362a99e83e462e8f9d9c7934aa3c83ef5db0c83c7fa1817ab
-
SSDEEP
1536:p+jJD/HBZbszKu9AZpy7r1jEwzGi1dDnDagS:p+CzK4AZwHCi1dXf
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 4 IoCs
Processes:
tmp.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe tmp.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe tmp.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e50c2e388f4a4092e8a1f2b2c9786ee0Windows Update.exe tmp.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e50c2e388f4a4092e8a1f2b2c9786ee0Windows Update.exe tmp.exe -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
tmp.exedescription ioc process File created C:\autorun.inf tmp.exe File opened for modification C:\autorun.inf tmp.exe File created F:\autorun.inf tmp.exe File opened for modification F:\autorun.inf tmp.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
tmp.exepid process 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe 392 tmp.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
tmp.exepid process 392 tmp.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
Processes:
tmp.exedescription pid process Token: SeDebugPrivilege 392 tmp.exe Token: 33 392 tmp.exe Token: SeIncBasePriorityPrivilege 392 tmp.exe Token: 33 392 tmp.exe Token: SeIncBasePriorityPrivilege 392 tmp.exe Token: 33 392 tmp.exe Token: SeIncBasePriorityPrivilege 392 tmp.exe Token: 33 392 tmp.exe Token: SeIncBasePriorityPrivilege 392 tmp.exe Token: 33 392 tmp.exe Token: SeIncBasePriorityPrivilege 392 tmp.exe Token: 33 392 tmp.exe Token: SeIncBasePriorityPrivilege 392 tmp.exe Token: 33 392 tmp.exe Token: SeIncBasePriorityPrivilege 392 tmp.exe Token: 33 392 tmp.exe Token: SeIncBasePriorityPrivilege 392 tmp.exe Token: 33 392 tmp.exe Token: SeIncBasePriorityPrivilege 392 tmp.exe Token: 33 392 tmp.exe Token: SeIncBasePriorityPrivilege 392 tmp.exe Token: 33 392 tmp.exe Token: SeIncBasePriorityPrivilege 392 tmp.exe Token: 33 392 tmp.exe Token: SeIncBasePriorityPrivilege 392 tmp.exe Token: 33 392 tmp.exe Token: SeIncBasePriorityPrivilege 392 tmp.exe Token: 33 392 tmp.exe Token: SeIncBasePriorityPrivilege 392 tmp.exe Token: 33 392 tmp.exe Token: SeIncBasePriorityPrivilege 392 tmp.exe Token: 33 392 tmp.exe Token: SeIncBasePriorityPrivilege 392 tmp.exe Token: 33 392 tmp.exe Token: SeIncBasePriorityPrivilege 392 tmp.exe Token: 33 392 tmp.exe Token: SeIncBasePriorityPrivilege 392 tmp.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
tmp.exedescription pid process target process PID 392 wrote to memory of 2916 392 tmp.exe netsh.exe PID 392 wrote to memory of 2916 392 tmp.exe netsh.exe PID 392 wrote to memory of 2916 392 tmp.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Drops startup file
- Drops autorun.inf file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\tmp.exe" "tmp.exe" ENABLE2⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
F:\Umbrella.flv.exeFilesize
93KB
MD59af8fc91af5e99e4373cbb5713dd40ec
SHA13ec0d34c5769ec819cb02a2d0bc8f7fde20505c9
SHA2561e7708aaa98da8303b9826e82ed2d0777a5684ecda49071eb91c9d0db4e02172
SHA512fb7bb746f660e024ed78c66ab9f5685e1d28b851dbf5227ddd09e686f13b8f3537c7678b8794e02362a99e83e462e8f9d9c7934aa3c83ef5db0c83c7fa1817ab
-
memory/392-0-0x0000000075460000-0x0000000075A11000-memory.dmpFilesize
5.7MB
-
memory/392-1-0x0000000075460000-0x0000000075A11000-memory.dmpFilesize
5.7MB
-
memory/392-2-0x0000000000C20000-0x0000000000C30000-memory.dmpFilesize
64KB
-
memory/392-21-0x0000000075460000-0x0000000075A11000-memory.dmpFilesize
5.7MB
-
memory/392-22-0x0000000075460000-0x0000000075A11000-memory.dmpFilesize
5.7MB