Analysis

  • max time kernel
    145s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-12-2023 16:07

General

  • Target

    tuc6.exe

  • Size

    6.9MB

  • MD5

    a4bbb0eb88b738924c5edd956e258e1b

  • SHA1

    882b59fd476fc3cb94d52aed70791de3db5c11bd

  • SHA256

    8d81a4b85f6db3ec50a42c04702288018d81a39e2b165a966f27cc523e878819

  • SHA512

    594900899aee4179054c6cb2b6fbed4ad4f41b2584bcefbb376f6779b5567d993ed37e99adbe9fc36f89f3f3ecbcc6962f553c4ef659ca2db9096be4da63e2d7

  • SSDEEP

    196608:Tbw61woT7mRIc+DaTblZEZTXuNkrAk8TQNY0pzj:Tbw61woTCR9+OTbl0Zo/Gzj

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Unexpected DNS network traffic destination 2 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 63 IoCs
  • Runs net.exe
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tuc6.exe
    "C:\Users\Admin\AppData\Local\Temp\tuc6.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5076
    • C:\Users\Admin\AppData\Local\Temp\is-JP8G0.tmp\tuc6.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-JP8G0.tmp\tuc6.tmp" /SL5="$40232,6958728,68096,C:\Users\Admin\AppData\Local\Temp\tuc6.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1752
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\system32\schtasks.exe" /Query
        3⤵
          PID:4344
        • C:\Program Files (x86)\ConvertWMA\wmaconvert.exe
          "C:\Program Files (x86)\ConvertWMA\wmaconvert.exe" -i
          3⤵
          • Executes dropped EXE
          PID:2012
        • C:\Windows\SysWOW64\net.exe
          "C:\Windows\system32\net.exe" helpmsg 11
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1604
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 helpmsg 11
            4⤵
              PID:2532
          • C:\Program Files (x86)\ConvertWMA\wmaconvert.exe
            "C:\Program Files (x86)\ConvertWMA\wmaconvert.exe" -s
            3⤵
            • Executes dropped EXE
            PID:4140

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\ConvertWMA\wmaconvert.exe

        Filesize

        1.1MB

        MD5

        49365f5aa48fe9dddbdd378db1968da8

        SHA1

        0ac3a9dc440e64957622ce40ed72f0d5ba3236b8

        SHA256

        2071a1738f23623f3a6d2be2c3f4af87072f801d09cd335ec528aa6e33132f1f

        SHA512

        7f09a98f8088a4da293460e1e74794d19ed29773be2031b03aa3df2bd8d6a2b20aa3c3b65d7da49ba6215482fb04afaca203f167d514395e4f14f4209b4593ad

      • C:\Program Files (x86)\ConvertWMA\wmaconvert.exe

        Filesize

        576KB

        MD5

        33b2c4198e1a1652bbb5304fe62182b4

        SHA1

        5b3ef60009cc82f61860132a23249c74bf55e144

        SHA256

        b2964638d44c004779c741d8b958033c8fcaecff8f272c0acb9b95b42440a26e

        SHA512

        4033ac2b65726743eadeb5b96d17878f56a586e9a71b1da42141fce1c3de2ef324aef730288d6580005a17d26ce5e3caf8a6be8c8c9e49df0dc2ca78795fa66d

      • C:\Program Files (x86)\ConvertWMA\wmaconvert.exe

        Filesize

        1.8MB

        MD5

        3a37f2b617ec8d6d2806d3fd94292c8d

        SHA1

        1a828850d72c3486a4aa30d9556941ec90f42536

        SHA256

        e26ce90a7a3266084baf1a9d617bbddfe6acec4d086d9be047daa0afb8d2726d

        SHA512

        2edd47804a5e393352aea25c91862823a99f756c7b1b2b5233e320279946ede8c2f74e05c08ca994cbc346115a1a5e980e2c968a9a52877fe0c281bf286530ca

      • C:\Users\Admin\AppData\Local\Temp\is-JP8G0.tmp\tuc6.tmp

        Filesize

        687KB

        MD5

        f448d7f4b76e5c9c3a4eaff16a8b9b73

        SHA1

        31808f1ffa84c954376975b7cdb0007e6b762488

        SHA256

        7233b85eb0f8b3aa5cae3811d727aa8742fec4d1091c120a0fe15006f424cc49

        SHA512

        f8197458cd2764c0b852dac34f9bf361110a7dc86903024a97c7bcd3f77b148342bf45e3c2b60f6af8198ae3b83938dbaad5e007d71a0f88006f3a0618cf36f4

      • C:\Users\Admin\AppData\Local\Temp\is-P69PF.tmp\_isetup\_iscrypt.dll

        Filesize

        2KB

        MD5

        a69559718ab506675e907fe49deb71e9

        SHA1

        bc8f404ffdb1960b50c12ff9413c893b56f2e36f

        SHA256

        2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

        SHA512

        e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

      • C:\Users\Admin\AppData\Local\Temp\is-P69PF.tmp\_isetup\_isdecmp.dll

        Filesize

        19KB

        MD5

        3adaa386b671c2df3bae5b39dc093008

        SHA1

        067cf95fbdb922d81db58432c46930f86d23dded

        SHA256

        71cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38

        SHA512

        bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303

      • memory/1752-161-0x0000000000400000-0x00000000004BC000-memory.dmp

        Filesize

        752KB

      • memory/1752-163-0x0000000002340000-0x0000000002341000-memory.dmp

        Filesize

        4KB

      • memory/1752-7-0x0000000002340000-0x0000000002341000-memory.dmp

        Filesize

        4KB

      • memory/2012-152-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/2012-154-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/2012-155-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/2012-151-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/4140-170-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/4140-179-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/4140-209-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/4140-205-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/4140-162-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/4140-157-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/4140-166-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/4140-167-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/4140-202-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/4140-173-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/4140-176-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/4140-159-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/4140-181-0x0000000000880000-0x000000000091E000-memory.dmp

        Filesize

        632KB

      • memory/4140-186-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/4140-189-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/4140-190-0x0000000000880000-0x000000000091E000-memory.dmp

        Filesize

        632KB

      • memory/4140-193-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/4140-196-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/4140-199-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/5076-2-0x0000000000400000-0x0000000000418000-memory.dmp

        Filesize

        96KB

      • memory/5076-0-0x0000000000400000-0x0000000000418000-memory.dmp

        Filesize

        96KB

      • memory/5076-160-0x0000000000400000-0x0000000000418000-memory.dmp

        Filesize

        96KB