Resubmissions

01-03-2024 13:36

240301-qwjzlsgf67 7

01-03-2024 10:28

240301-mh2eysff34 7

Analysis

  • max time kernel
    119s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    01-03-2024 10:28

General

  • Target

    TPS V2 Umi Keygen.exe

  • Size

    1.3MB

  • MD5

    cda78cc7005ed4318373322df18e9f1b

  • SHA1

    5b32d63c65c9e0c2d500fd6cce90d3c5e5a87b19

  • SHA256

    21b9d087307d06d9ca9d92d9a7721429342bf923263f5b5355b2f23650eb2640

  • SHA512

    aadee4c2954554cd4599a397635c7f3bb92c428cfd53057913782bc7fcaf4d91bab0cbb574f14ad4f84cf4223ea506a7db5931a2cf7cb2130a6c0e05b770761e

  • SSDEEP

    24576:XubsnafAPyjzbmlQQyCqpdh1PfXOrPBuKCnFnnW68B6UpCfh8VzSjBlyq/t/tD:fI3mSQFErnMJujnFnV8B6xh2zYoqNtD

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 9 IoCs
  • Obfuscated with Agile.Net obfuscator 2 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TPS V2 Umi Keygen.exe
    "C:\Users\Admin\AppData\Local\Temp\TPS V2 Umi Keygen.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1796
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\TPS Tool V3.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\TPS Tool V3.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2252
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 768
        3⤵
        • Loads dropped DLL
        • Program crash
        PID:2736

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\RarSFX0\TPS Tool V3.exe

    Filesize

    430KB

    MD5

    aa307365f26331d9172190d595771601

    SHA1

    f57d8851c804c94578277c32f377ab14f8ab1fa5

    SHA256

    3bdb8e8f053bbf758588c7dc39ecab3bca2152f4d9f20b4ebc5fe52d38592e4a

    SHA512

    3891c7e2f141d1b8ebdad1061b8cbe9f51c5a49cbaace6cae6524d7edffa128285e96d79ba860278b7f37bae81c32e3a32eea89ec1b4436d668f4a3056a34420

  • memory/2252-22-0x0000000000EB0000-0x0000000000F28000-memory.dmp

    Filesize

    480KB

  • memory/2252-23-0x0000000073890000-0x0000000073F7E000-memory.dmp

    Filesize

    6.9MB

  • memory/2252-29-0x0000000073890000-0x0000000073F7E000-memory.dmp

    Filesize

    6.9MB