Overview

overview

10

Static

static

3

tmp.exe

windows7-x64

10

tmp.exe

windows10-1703-x64

10

tmp.exe

windows10-2004-x64

8

tmp.exe

windows11-21h2-x64

1

Resubmissions

12/04/2024, 15:05

240412-sgj26see2v 10

12/04/2024, 15:05

240412-sggl2see2s 10

12/04/2024, 15:05

240412-sgf1hsbe23 10

12/04/2024, 15:05

240412-sgbqssbd99 10

12/04/2024, 15:05

240412-sga49sbd98 10

09/04/2024, 07:59

240409-jvg1asab26 10

09/04/2024, 07:59

240409-jvgdrsdd5w 10

09/04/2024, 07:59

240409-jvfr8sdd5v 10

09/04/2024, 07:59

240409-jvfggadd5t 10

19/01/2024, 20:24

240119-y6y6aadfb5 10

Analysis

  • max time kernel
    279s
  • max time network
    296s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    09/04/2024, 07:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    tmp.exe

  • Size

    5.9MB

  • MD5

    bbe98cc2bf5ce0c0bb4fb74370e2af68

  • SHA1

    6a363ce866e541105642c2b35e048998e2dfdfea

  • SHA256

    20c0e8522d9e6fe9d45784826521416b657baeefd6c3dde33d7526a8dc7fff2b

  • SHA512

    900b23e8095ff64fc7d8b5d169204733410734046d0be059e60fe88be32c09e578ac94bdb466f4eba8565d78685aec499cbbfcb1332f6d90626bbb999690b762

  • SSDEEP

    98304:lIIuKCEdO96Xkmby531xv91EZJ9XARo00k3NPedyEhyeSDwlqGuLpnKriRkS8KRn:lTO96bby5jv91SFVkoyEhyeSuuLpyfjm

Score
10/10
evasiontrojan

Malware Config

Signatures

  • Modifies security service 2 TTPs 2 IoCs
    evasion
  • Modifies Windows Firewall 2 TTPs 6 IoCs
    evasion
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Drops file in System32 directory 3 IoCs
  • Drops file in Windows directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1992
    • C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
      2⤵
      • Modifies Windows Firewall
      PID:2648
    • C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
      2⤵
      • Modifies Windows Firewall
      PID:1960
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2484
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2440
    • C:\Windows\System\dc.exe
      "C:\Windows\System\dc.exe" /D
      2⤵
      • Modifies security service
      • Executes dropped EXE
      • Windows security modification
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      PID:1624
    • C:\Windows\system32\schtasks.exe
      schtasks /delete /TN "Timer"
      2⤵
        PID:2640
      • C:\Windows\system32\schtasks.exe
        schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
        2⤵
        • Creates scheduled task(s)
        PID:1224
      • C:\Windows\System\svchost.exe
        "C:\Windows\System\svchost.exe" formal
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:2572
        • C:\Windows\System32\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
          3⤵
          • Modifies Windows Firewall
          PID:2912
        • C:\Windows\System32\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
          3⤵
          • Modifies Windows Firewall
          PID:780
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1708
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2072
        • C:\Windows\System\dc.exe
          "C:\Windows\System\dc.exe" /D
          3⤵
          • Modifies security service
          • Executes dropped EXE
          • Windows security modification
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          PID:2332
        • C:\Users\Admin\AppData\Local\Temp\~tl1CA5.tmp
          C:\Users\Admin\AppData\Local\Temp\~tl1CA5.tmp
          3⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1616
          • C:\Windows\system32\netsh.exe
            netsh int ipv4 set dynamicport tcp start=1025 num=64511
            4⤵
              PID:1920
            • C:\Windows\System32\netsh.exe
              "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
              4⤵
              • Modifies Windows Firewall
              PID:1648
            • C:\Windows\System32\netsh.exe
              "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
              4⤵
              • Modifies Windows Firewall
              PID:2332
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
              4⤵
                PID:2728
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                4⤵
                  PID:1656
                • C:\Windows\system32\schtasks.exe
                  schtasks /delete /TN "Timer"
                  4⤵
                    PID:1924
                  • C:\Windows\system32\schtasks.exe
                    schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
                    4⤵
                    • Creates scheduled task(s)
                    PID:1808
                  • C:\Windows\System\svchost.exe
                    "C:\Windows\System\svchost.exe" formal
                    4⤵
                      PID:3016
              • C:\Windows\system32\gpscript.exe
                gpscript.exe /RefreshSystemParam
                1⤵
                  PID:1576
                • C:\Windows\system32\gpscript.exe
                  gpscript.exe /RefreshSystemParam
                  1⤵
                    PID:2636

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\zrkdkto
                    Filesize

                    108KB

                    MD5

                    07232b64be72593980cd952e8f85017e

                    SHA1

                    61dba57cc51f4501ace3520e2cf559d8e42e04d7

                    SHA256

                    ef342bcc3c938c2fa9b38bc84019d8dce94d018372f7d9c29a8ee7ff3f0fc3a8

                    SHA512

                    d5417f270e14fe3437c0d017e037117001377379475531b70f9d6840548dd830117fbf62c152c9af09f586bdf944edac330bc560cca4fa45105269319e7158cb

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                    Filesize

                    7KB

                    MD5

                    9e60fcf1d190832922044e3ba4d2703a

                    SHA1

                    2311305da6647897c5c4c1dc2866390c2cb84508

                    SHA256

                    a2263f93cb05053f62ffc8a7102b17cb2a42dbcea78d648b30472c5f9a78df03

                    SHA512

                    eaa000108624111025f34a9778f9b1fea0919536774630d589dd13c68f39f36c6e21f2b1318b10df951a223359a4960545645f5551afaddce8202fb9516190a4

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8386B2DC0Q31GNGQYK4Z.temp
                    Filesize

                    7KB

                    MD5

                    45a7c4e63d73b20500caee81461ce93c

                    SHA1

                    0b748f8073010bdddd6aa06ac8b68991ad4fcf5a

                    SHA256

                    f87a56445aefa75ac98a890c0a16276c160a59f4f702c0d10e42f63bd935b7c4

                    SHA512

                    eef5832573c822141c80c5c92563a7985faef6a43c0370eeb8bb5e7b780ccfa89643f8efd6362e49acd886048626f1e47fdc4852b498bbdd8b0b0b6eceb4c4f4

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MG4T2V4L3JZH73MTLN5B.temp
                    Filesize

                    7KB

                    MD5

                    04c2e6d5e05c7066a690f818792765d6

                    SHA1

                    e0871d455493895a02a08608cb9767211791c8b5

                    SHA256

                    631e5201b02d1523527729e067293ff07c70f48a78496718ea60c524225cd352

                    SHA512

                    47abf9b2362a1ace40e9d391d77b8aa30219da7f37cfd4d619de12d32f1805ba86d959bfece914086622aab898a5c15c679196b5816e16ff31fb45a67780fa9c

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\tor\cached-microdesc-consensus.tmp
                    Filesize

                    2.6MB

                    MD5

                    3af58b6add70a3559c53205e4aefd0f9

                    SHA1

                    5c1a95db8a1695b14b26cb5e8ae92fea5bd9da41

                    SHA256

                    d9595b5e4bb49267b93c50334024de412c0e8a2831f2caa1102529292b9c2a7e

                    SHA512

                    21b93f9444d559aa19fd36afd939120623187fd42cf43296447cfa8794d7a72773900405b37587def2e794b7e829d337aaf5b397a8882552875a89023f104f97

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
                    Filesize

                    10.6MB

                    MD5

                    566cba964827e62189860aa64e1275e5

                    SHA1

                    c3d488409b25026b5189a045310531d3a60b60ee

                    SHA256

                    adb84132fa0056f1df28e7336fc6f7bcef6b5c777dda55fc35fbb2986aaabc27

                    SHA512

                    a027883ebf07f9031e0d175f2466401c6f4e73c17b62c83a87a2de95254cefe7d8726bf24cc23e801269ab883aa0171b48f2f9699d18e38a9c4c4b4d2339480d

                    Download Submit

                  • C:\Windows\System32\GroupPolicy\gpt.ini
                    Filesize

                    233B

                    MD5

                    cd4326a6fd01cd3ca77cfd8d0f53821b

                    SHA1

                    a1030414d1f8e5d5a6e89d5a309921b8920856f9

                    SHA256

                    1c59482111e657ef5190e22de6c047609a67e46e28d67fd70829882fd8087a9c

                    SHA512

                    29ce5532fb3adf55caa011e53736507fbf241afee9d3ca516a1d9bffec6e5cb2f87c4cd73e4da8c33b8706f96ba3b31f13ce229746110d5bd248839f67ec6d67

                    Download Submit

                  • C:\Windows\system\dc.exe
                    Filesize

                    763KB

                    MD5

                    0a50081a6cd37aea0945c91de91c5d97

                    SHA1

                    755309c6d9fa4cd13b6c867cde01cc1e0d415d00

                    SHA256

                    6606d759667fbdfaa46241db7ffb4839d2c47b88a20120446f41e916cad77d0b

                    SHA512

                    f0a4e9a3dc065df2182527b17077c822d4535db86bf61f5ee795ee469b15159560a8e81e60d3037f3de1bb38e92f0fc8a422c2656882650d699e2b96948f9846

                    Download Submit

                  • C:\Windows\system\svchost.exe
                    Filesize

                    5.9MB

                    MD5

                    bbe98cc2bf5ce0c0bb4fb74370e2af68

                    SHA1

                    6a363ce866e541105642c2b35e048998e2dfdfea

                    SHA256

                    20c0e8522d9e6fe9d45784826521416b657baeefd6c3dde33d7526a8dc7fff2b

                    SHA512

                    900b23e8095ff64fc7d8b5d169204733410734046d0be059e60fe88be32c09e578ac94bdb466f4eba8565d78685aec499cbbfcb1332f6d90626bbb999690b762

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\~tl1CA5.tmp
                    Filesize

                    385KB

                    MD5

                    e802c96760e48c5139995ffb2d891f90

                    SHA1

                    bba3d278c0eb1094a26e5d2f4c099ad685371578

                    SHA256

                    cb82ea45a37f8f79d10726a7c165aa5b392b68d5ac954141129c1762a539722c

                    SHA512

                    97300ac501be6b6ea3ac1915361dd472824fe612801cab8561a02c7df071b1534190d2d5ef872d89d24c8c915b88101e7315f948f53215c2538d661181e3a5f0

                    Download Submit

                  • memory/1616-199-0x0000000140000000-0x000000014015E400-memory.dmp

                    Filesize

                    1.4MB

                    Download

                  • memory/1616-160-0x0000000140000000-0x000000014015E400-memory.dmp

                    Filesize

                    1.4MB

                    Download

                  • memory/1616-159-0x0000000140000000-0x000000014015E400-memory.dmp

                    Filesize

                    1.4MB

                    Download

                  • memory/1616-158-0x0000000140000000-0x000000014015E400-memory.dmp

                    Filesize

                    1.4MB

                    Download

                  • memory/1616-157-0x0000000140000000-0x000000014015E400-memory.dmp

                    Filesize

                    1.4MB

                    Download

                  • memory/1656-180-0x00000000027E0000-0x0000000002860000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/1656-183-0x00000000027EB000-0x0000000002852000-memory.dmp

                    Filesize

                    412KB

                    Download

                  • memory/1656-179-0x000007FEF52A0000-0x000007FEF5C3D000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/1656-181-0x00000000027E4000-0x00000000027E7000-memory.dmp

                    Filesize

                    12KB

                    Download

                  • memory/1656-182-0x000007FEF52A0000-0x000007FEF5C3D000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/1656-184-0x000007FEF52A0000-0x000007FEF5C3D000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/1708-66-0x0000000001E00000-0x0000000001E08000-memory.dmp

                    Filesize

                    32KB

                    Download

                  • memory/1708-63-0x000000001B720000-0x000000001BA02000-memory.dmp

                    Filesize

                    2.9MB

                    Download

                  • memory/1708-68-0x0000000002BA0000-0x0000000002C20000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/1708-69-0x0000000002BA0000-0x0000000002C20000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/1708-65-0x0000000002BA0000-0x0000000002C20000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/1708-70-0x0000000002BA0000-0x0000000002C20000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/1708-67-0x000007FEF52A0000-0x000007FEF5C3D000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/1708-64-0x000007FEF52A0000-0x000007FEF5C3D000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/1708-81-0x000007FEF52A0000-0x000007FEF5C3D000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/1992-23-0x00000001406F2000-0x00000001406F3000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1992-0-0x00000001406F2000-0x00000001406F3000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1992-1-0x0000000140001000-0x000000014002B000-memory.dmp

                    Filesize

                    168KB

                    Download

                  • memory/2072-83-0x000007FEF52A0000-0x000007FEF5C3D000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/2072-78-0x0000000002DD0000-0x0000000002E50000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/2072-80-0x0000000002DD0000-0x0000000002E50000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/2072-82-0x000007FEF52A0000-0x000007FEF5C3D000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/2072-84-0x0000000002DDB000-0x0000000002E42000-memory.dmp

                    Filesize

                    412KB

                    Download

                  • memory/2072-77-0x000007FEF52A0000-0x000007FEF5C3D000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/2072-79-0x0000000002DD0000-0x0000000002E50000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/2440-22-0x0000000002C70000-0x0000000002CF0000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/2440-18-0x000007FEF5090000-0x000007FEF5A2D000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/2440-21-0x0000000002C74000-0x0000000002C77000-memory.dmp

                    Filesize

                    12KB

                    Download

                  • memory/2440-19-0x0000000002C70000-0x0000000002CF0000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/2484-16-0x0000000002834000-0x0000000002837000-memory.dmp

                    Filesize

                    12KB

                    Download

                  • memory/2484-14-0x0000000002830000-0x00000000028B0000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/2484-6-0x000000001B760000-0x000000001BA42000-memory.dmp

                    Filesize

                    2.9MB

                    Download

                  • memory/2484-7-0x0000000001E00000-0x0000000001E08000-memory.dmp

                    Filesize

                    32KB

                    Download

                  • memory/2484-13-0x000007FEF5090000-0x000007FEF5A2D000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/2484-15-0x000007FEF5090000-0x000007FEF5A2D000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/2484-17-0x0000000002830000-0x00000000028B0000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/2484-20-0x000007FEF5090000-0x000007FEF5A2D000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/2572-101-0x000000001EED0000-0x000000001F3B2000-memory.dmp

                    Filesize

                    4.9MB

                    Download

                  • memory/2728-173-0x000007FEF49C0000-0x000007FEF535D000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/2728-172-0x0000000002C80000-0x0000000002D00000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/2728-171-0x0000000002C80000-0x0000000002D00000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/2728-170-0x0000000002C80000-0x0000000002D00000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/2728-166-0x000000001B6F0000-0x000000001B9D2000-memory.dmp

                    Filesize

                    2.9MB

                    Download

                  • memory/2728-169-0x000007FEF49C0000-0x000007FEF535D000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/2728-168-0x0000000002C80000-0x0000000002D00000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/2728-167-0x000007FEF49C0000-0x000007FEF535D000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/3016-198-0x0000000140000000-0x000000014015E400-memory.dmp

                    Filesize

                    1.4MB

                    Download