381e9697e2d5fa34d69d4eabea34cdc8d05ecb7066a36fff0fd21975377dbb37

Analysis

max time kernel
145s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 17:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

4.6MB
MD5

589b7f6646d2ccb002ff684a660ebf9f
SHA1

fc65f5df194cafbd87f2611e744ccd4733bb6a15
SHA256

381e9697e2d5fa34d69d4eabea34cdc8d05ecb7066a36fff0fd21975377dbb37
SHA512

da80430ca1e0231236a74fa7fdea271b84bc8f3487cb196e9804ea39ca8702f46195af1732792d76fdf3d7c6e2307b469e601b800805a91693b81babbfdaba61
SSDEEP

98304:Rd5bSIQh5iiRDwn5RgsLtDzMYZY0/nW4qhws6twQQPZmk90252:k6vWXjC252

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2536	tmp.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Payday 3 Updater\settings.ini

Filesize
166B

MD5
fe21874706e48da151c9de0ad183bb18

SHA1
2d60ae6c4fa4d9fc18948c53f058f34f06dfc8ea

SHA256
9f6c8e71d4720a0d928f7b6674c787b163b5c5e9e3037badd6dc0cc658844d91

SHA512
6619a54b475d3e06b0ca484bd1b2c5fe3b4d0eb09a97f3082d4c01231f541170d330ecf4396daa8017103fe124166fba8248f9cc9f06e0c76d0c9e6ff985a5f5

Download Submit