Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
11/12/2023, 17:21
General
-
Target
tuc7.exe
-
Size
7.5MB
-
MD5
58f18fae24337f96a5200aff450ce1d5
-
SHA1
2760805c26993efb6c4461bdb78d9e7edec37639
-
SHA256
f50f345ac0afc42389ad774169a54e2dcb17f4c173559c40f0bc1dc544caba2e
-
SHA512
80f9b23ed330f16198b51514bb3ed81e517152259aa76a1d2710759d1f751f35553e35bb7706e029dcb128303ffd02cacf74abcc9295e405c7f2f60a0c9bf087
-
SSDEEP
196608:PWc5A2XV/1qTZGgnkphp0rAwZYGespRHDfY5cdV4qCzj:/DFyOTpBsLp1c5SV4qCzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 6 IoCs
-
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 27 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\is-6M990.tmp\tuc7.tmp"C:\Users\Admin\AppData\Local\Temp\is-6M990.tmp\tuc7.tmp" /SL5="$4001C,7612629,68096,C:\Users\Admin\AppData\Local\Temp\tuc7.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query2⤵
-
-
C:\Program Files (x86)\PlayGIF\gifplayer.exe"C:\Program Files (x86)\PlayGIF\gifplayer.exe" -i2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\PlayGIF\gifplayer.exe"C:\Program Files (x86)\PlayGIF\gifplayer.exe" -s2⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 112⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\AppData\Local\Temp\tuc7.exe"C:\Users\Admin\AppData\Local\Temp\tuc7.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 111⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD5c00315a88342a0abb54a3d9ceb5f46d2
SHA1f8625a27daf775612dea61ec22a20044a80b8ac2
SHA256536fca271c4bfe6428f9a20a855691b3a80dab24a487f228a94149448b050cfb
SHA512d88d1ce867cabdc8f67e5d648ff8b9db2cf6d284a7232ad030d2b5db86dbb4e14868faaa62d8d3a00e612bb2f8c7be1b2deac19686afc4655b45766ca64b079e
-
Filesize
500KB
MD502e928d600926ec09cc158660b8b985e
SHA1f053e48145d6dc3f08ce3fb7a79a6f2151618a79
SHA25650a88ff39e66803d76c33b63dd4b5af0615c3523f3e507a6ff9e87d2968c6c04
SHA51234df69ce432c9fa9ddf34d9a8e2c32e5d231e6daf21cc8c0d957ab91b1707fea07caa4738ea21f3beacd6bb676819ff8e0c2cadfbbfb88c6cda1d4f89fcce6f5
-
Filesize
354KB
MD565eff6327ca9cb1e45fab09af58c8b9b
SHA1f730f062094598a094bfbb7c9e0cf7a3d4d02ea7
SHA256bd3bf57eeb08c45983a40253a71cbddbe9af954a3e2680872815902f9fffc419
SHA512d94d0c5e14e514a84828b47d59690943e669e45985814f6a6a823b316536056a5d93541ee3d7800ad3f3444cf6d9a6302da184b644ef67f4ce012a946745b3af
-
Filesize
617KB
MD50d83c54ae7c803d14582cfb26d0ddc78
SHA1184f5190bb42977d65992ca6f9d84d759a6846e6
SHA256ac8c33322b2a4e081c312a6d2d754c9d1c72bfe64d42547720961f651cea2921
SHA51234385be1172cc92a435cd5011136c64a25ba00da5be522b5a5a6a12a888498318ec5a2a2f2ba2f29bd75a31e317c131be8a99416812d4decdc2e39b405278e50
-
Filesize
265KB
MD568b7004c225526e5621201835b27e18f
SHA1d7d141816bffbf688c9116ea2ee80bfeb4c783f7
SHA25631d670b62977842700789361fdf2479d037e2f612bba2a4820cbd30c9db6b4f4
SHA51281c87ccaea7e2246d2516b106b8b102808b3d1dd181fb49ba89dfa103aa94c9de1695ae828dd5d73148e7ea897fb48f91dd99d89c198bac7d76295773b5ec134
-
Filesize
2.4MB
MD538b30bb4287d79bbba393c7e566082de
SHA10e17117c3e2c0b935ae23514c8b81e4fbdda06cd
SHA2563e213129843ec7d47055e10c8497db8792d807207c71bf0a4f2ec8ad566f6c3b
SHA5127baa554fa1f78cd056df3817f45d9f9db15807a2ab35b6d168ce9ef5d851156a4eb98119394042cb19dbc68c71b1ac3b3ad3d23522f71a25b8cb30a64a16edf0
-
Filesize
315KB
MD5ec5cddf15622de83c09ce2637fdbae79
SHA1b89a5c129d61864c2eb1036dc826a857502a84a5
SHA256b2d2c575815021f31cc01d77fc4166d10a75ec35aec8bac762b31e06d09ad5ee
SHA51230096313cbf272e92b9c88e92d4d36a77ca766673fb28f12d1c4679cb634d1311d2c8361d3ff289268ac471478c148a94c5fcdb24b711edcdb3454aa438194e7
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
752KB
-
Filesize
4KB
-
Filesize
2.4MB
-
Filesize
4KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
2.4MB
-
Filesize
632KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
632KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
632KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB