Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
-
submitted
12/12/2023, 16:45
General
-
Target
tuc7.exe
-
Size
7.0MB
-
MD5
5af1fcb9ad4bdf29b37aeaf5ff636651
-
SHA1
b0c7eda67bd98e5aae35d6dd045fd6e67e518356
-
SHA256
670c53e661d7b4a59476c616f9d391ce943c6ac63d430ec76d99b6e54fa2d524
-
SHA512
88dec474310e8f2b2a7cb62413a836d8722e5ed7339f51c9fafdcb664e58bf3eff131ab0bb517a6dcb12ccda3f00f29d88af5d83c541c60d02133e532a2c80ca
-
SSDEEP
196608:9xm5Z7xPjWtYOkdHWd1V3GaO4TwWHvzASW8P7Bzj:y7RjWtfj95dLASWyzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tuc7.exe"C:\Users\Admin\AppData\Local\Temp\tuc7.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-1V68Q.tmp\tuc7.tmp"C:\Users\Admin\AppData\Local\Temp\is-1V68Q.tmp\tuc7.tmp" /SL5="$40206,7089240,121856,C:\Users\Admin\AppData\Local\Temp\tuc7.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\numGIF\numgif.exe"C:\Program Files (x86)\numGIF\numgif.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\numGIF\numgif.exe"C:\Program Files (x86)\numGIF\numgif.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 123⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 124⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD514d2d06d611c89a20030ce9c65d007e5
SHA1747d243c6b7fc5a4c1997c5c184f90f52a2ae1ca
SHA256dabcc2f1b9a3f4e6fd201c47a5f0595eae35c48ebc469d7d1f0fd5ff66df4ff9
SHA512569f9fbcb5d36551dee9a3947eba91dcb74e6c7e98bab12dfc1ecde30560ab9a50ce268f551d09ba7b1bbec5c1b5dbc092a5b53352a9645c0de7fb153cccbe68
-
Filesize
429KB
MD5a64818d861794c755d8e719363fa4984
SHA1a28e140dc1b07e2585a324aba3adfb0b50b83fd9
SHA2560f7cb5aed266e7d46d4ff5591efae3c3eb278e4aed5ba31c5461d42a3ae738ce
SHA5124d40ebccaf0d3ede31ff61c6355e16ece304939c5495a45b51bfed270f5123a1cd27f33d1260f5012666abfe7404bf9691f60a455def09a9eed3571bf67172b3
-
Filesize
273KB
MD5b90326c50c6c3cf8e71be029b28b5448
SHA104f313e35f23469f442709860b1a552b9bb0c79c
SHA2568aa3dc5ca5ad81a696d03ca01d7e9a36d398484866e912aa0a8794974ea2c0d3
SHA512759d013c4ca93a9e8bd6171f5581ea2d3c1dccc4dfbfb512a125bb1bb4771b935911740c31d8a58080aaf38348a9368e9c438cc15b6ecabb5912b9714d07a9a5
-
Filesize
47KB
MD5db6ccc61a989efbfd166a982ea8fb916
SHA1dbae8e4a5e8064950dd4f5cc21587e5c3243f3ab
SHA256f48e0d193c9d1b4215aadb393808e7c03d9959112ffca2c8ba179a7c919e3c68
SHA51267c13e327d70e9c02384d05018e534866cb7f291b0195545afbd8bd605743496c525741779dbfd5c864ef0d60e1dabddb809210dfcc08c07c732ca6fb8deebdc
-
Filesize
73KB
MD5a24ae7f88a59a60a6bad8fd8e2685a89
SHA19e161bb190bd1fc43fc21b878324e2058ff4b003
SHA2569b98e46b107920127341891bf1ced434435ffad5fb225d668a191902917eee87
SHA512c19e9b1ada6326aa504f2933eb83d1ec07368f1ebf6b8078c752e8353ed8d46d821f345a713023a307e612f1e24f42d85cd59af4cef423c6d27a237cb7da6fd4
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
148KB
-
Filesize
148KB
-
Filesize
148KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
632KB
-
Filesize
2.0MB
-
Filesize
632KB
-
Filesize
2.0MB
-
Filesize
632KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB