Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231130-en -
resource tags
-
submitted
11/12/2023, 16:08
General
-
Target
tuc4.exe
-
Size
6.9MB
-
MD5
aa76d89cd2cb04a6fc3ad2fef096ac65
-
SHA1
9feb12f808b3686a6e54d824af44fa4561e266fe
-
SHA256
710e0b9618294908a87b16a4acdd9face597754ee11720dab5b094d6bcbebb1a
-
SHA512
6ab5c0e2b7f519a9c8f106363caa190ea00b9b3a95e64e6885968b490feef023b30a088084f2a8cebfe55e061238a0f0b7a2cc6cd9215af7ccc9fda4e634b847
-
SSDEEP
196608:bDoG3bFqjpLC0TSMLsn33HR83v9i8l7INzj:bDyNLCWZ2HS9iQ7INzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 6 IoCs
-
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 27 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tuc4.exe"C:\Users\Admin\AppData\Local\Temp\tuc4.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-1H9TG.tmp\tuc4.tmp"C:\Users\Admin\AppData\Local\Temp\is-1H9TG.tmp\tuc4.tmp" /SL5="$30140,6971036,68096,C:\Users\Admin\AppData\Local\Temp\tuc4.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\ConvertWMA\wmaconvert.exe"C:\Program Files (x86)\ConvertWMA\wmaconvert.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\ConvertWMA\wmaconvert.exe"C:\Program Files (x86)\ConvertWMA\wmaconvert.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 111⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD5065f9a912f210793d19385e49aac50a7
SHA176a08e98e8a71ef2e97b1c4caa1c86ffdb6c0a34
SHA256817a6f50ca49321ddb4a0cff59e8cdbfe2e1bffe6cc7fb32bba94eb5fbf5317d
SHA5128999c116f8a176d296ce95c2ae8fa1e8cc83d644bc4c76483215d17c60c9dc6a63ec1553e902e3519ca333b79ed790f3502aa960f5fcdca13f1ba4c4b06216c0
-
Filesize
467KB
MD52819c16a7097e06549c6851f1299459f
SHA197c494d885d2a18d75d32d0b206f7365abc9f52a
SHA256becb2e18e68d49c2409b6e2c2883fc22217e4d39e92c69671eea9e2b2fb435d6
SHA5123e3ac2ea986601e250e31a4365ee103a0276d2d44abc38bffb5efed4e7e895c09e0ff5301ad587563a39959b62069c17b4e4aa8eb9fc13442d75c714622b55f6
-
Filesize
276KB
MD559b5d4b0aff148f6513f59975ac9751d
SHA1ed3c7494da8fae0acee856c0073d0cb1ff8430e4
SHA2567078382ae743b2612f280764a69518bb6856aa743f8f07eefd79a1c4b43d1b80
SHA512e773152a797673aaed18c4d135ca45ed416a68c451768a0bb2c31d99a6a7ea93aa741bff63201483b3bda9081a651b1a87f1c5ac7c9dd44641f49de18e580e62
-
Filesize
361KB
MD558ee01b8912b9c9add6883dd944215c8
SHA1bd4080126c08db31771c9fe3b624a1e2dd9577c2
SHA2561e7be33b537d4ec66277d3f96d4f8fe8f3b52110a1bd400e9b4875b51e6f27c3
SHA512d44c79f3276bf26eefe27d7f45dd39d3c2e1a4d0be7472e28cfaec85ecd58d849e45ecc43343dcdbb3811bb39ac70a83ee62a7b5eb7bc61f118d1d6f3e782c90
-
Filesize
447KB
MD5959c8d4c36ffeb9eff20f04cdfd99f4a
SHA1b89b26b359a38390c88ddf0fcb080e3ebb5b8e36
SHA256ab21ddc440c0c08a79c96efd6aeec64a8e9ce1fa6cee95dd9f7523346fbbb07e
SHA512bd0091fef358bd6ad5bae06e0dd4e1003399822fb132424606729c9c83aa012d088dc9c2884e0b29aa072b702748d5cbdf3acdab21851f97773ee7e774d7ec68
-
Filesize
216KB
MD516277c96bd82cda79cb5567757ce15e6
SHA1c35efab1bc160071e39661a7de66668edff71a22
SHA256263744e5c56bd8079faa53366e30ccd9da543e36f593908b5dae6737d557865f
SHA5121bc334990eb6617127d30c001831df74627a0feab44854c1cf56f2ae76601243646fee9f398f00c0ebee4d5f2ea6bab7dc62367e3a29463a240397cafe48a514
-
Filesize
663KB
MD5060bc6eff5448a8fd80414f90f8c5a69
SHA1d33209af451607de82ae6ae47b95e1cb1c032d88
SHA25621dede1d3fd9bed48369900392f06fee90f8ab9d719c69d25541e04185881823
SHA512d82c4c71ed901f7106120d66e3733a4b9776061a1f8ea1e0df9496796c941ab9dffd3823c3b7218360b62af3866d1ee57db913b293c1369aa26bf83553edb406
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
4KB
-
Filesize
1.8MB
-
Filesize
4KB
-
Filesize
1.8MB
-
Filesize
752KB