Resubmissions

01-03-2024 13:36

240301-qwjzlsgf67 7

01-03-2024 10:28

240301-mh2eysff34 7

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-03-2024 10:28

General

  • Target

    TPS V2 Umi Keygen.exe

  • Size

    1.3MB

  • MD5

    cda78cc7005ed4318373322df18e9f1b

  • SHA1

    5b32d63c65c9e0c2d500fd6cce90d3c5e5a87b19

  • SHA256

    21b9d087307d06d9ca9d92d9a7721429342bf923263f5b5355b2f23650eb2640

  • SHA512

    aadee4c2954554cd4599a397635c7f3bb92c428cfd53057913782bc7fcaf4d91bab0cbb574f14ad4f84cf4223ea506a7db5931a2cf7cb2130a6c0e05b770761e

  • SSDEEP

    24576:XubsnafAPyjzbmlQQyCqpdh1PfXOrPBuKCnFnnW68B6UpCfh8VzSjBlyq/t/tD:fI3mSQFErnMJujnFnV8B6xh2zYoqNtD

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Obfuscated with Agile.Net obfuscator 2 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TPS V2 Umi Keygen.exe
    "C:\Users\Admin\AppData\Local\Temp\TPS V2 Umi Keygen.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:548
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\TPS Tool V3.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\TPS Tool V3.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4812

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\HuaweiUpdateLibrary.dll

    Filesize

    21KB

    MD5

    81a188ac5da8e396126bbff00430f6f9

    SHA1

    ab98043226e10a53101835cbdb1c0f8068c9ef3a

    SHA256

    6db66509ae09649c059b63d9ca036c7a37dc213ac478ffd03223efb4eec6b922

    SHA512

    4942a7666f7e58b213e2a1da14f3be32d81fbca0f063a5dd775957d8550538e566f654131065e50eda3b0cb931637536fe472cd677f17e7fd8ba5808be0ff059

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\TPS Tool V3.exe

    Filesize

    430KB

    MD5

    aa307365f26331d9172190d595771601

    SHA1

    f57d8851c804c94578277c32f377ab14f8ab1fa5

    SHA256

    3bdb8e8f053bbf758588c7dc39ecab3bca2152f4d9f20b4ebc5fe52d38592e4a

    SHA512

    3891c7e2f141d1b8ebdad1061b8cbe9f51c5a49cbaace6cae6524d7edffa128285e96d79ba860278b7f37bae81c32e3a32eea89ec1b4436d668f4a3056a34420

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\tpsControllerLib.dll

    Filesize

    541KB

    MD5

    6d1a30cea4ad42edb142dfa44832e108

    SHA1

    e7fb38884f7586236ca6adebd9bb12ebe1784748

    SHA256

    1c38284d7cfb0b7dd09012d9de10e92a1c9ee7a8ea33f6489201a71d80d12457

    SHA512

    ae96a8d9ce586ac83a31d8d381347c28ab1863c138bd1b0ffbe1ac4798bc1358e61bf72bbcf0436dac2a730cb468c1ccc046a64488e02ef775808a23bd3f565d

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\tpsThemeLib.dll

    Filesize

    433KB

    MD5

    bbf4d1132f017b5e723402caa109c70c

    SHA1

    d91dddbb8b1b2b516d7956b04e57864d4e47c8b0

    SHA256

    037b9e81977a0fbdcebf942f88fdf548c3e9173df5a8fc55236eeefe30ee6fbb

    SHA512

    82249ed7f81a2242ac2846df7835807134fddc8a9e7191b581959bcbca24c725ce6dbce64a7b82d5e6c815273084a2f0a3bf176552c43b3c353812f3cb572e86

  • memory/4812-30-0x00000000092A0000-0x00000000093BE000-memory.dmp

    Filesize

    1.1MB

  • memory/4812-19-0x0000000072580000-0x0000000072D30000-memory.dmp

    Filesize

    7.7MB

  • memory/4812-23-0x00000000053F0000-0x0000000005400000-memory.dmp

    Filesize

    64KB

  • memory/4812-24-0x0000000006430000-0x000000000643A000-memory.dmp

    Filesize

    40KB

  • memory/4812-31-0x00000000053F0000-0x0000000005400000-memory.dmp

    Filesize

    64KB

  • memory/4812-26-0x0000000072580000-0x0000000072D30000-memory.dmp

    Filesize

    7.7MB

  • memory/4812-22-0x0000000005570000-0x00000000055D6000-memory.dmp

    Filesize

    408KB

  • memory/4812-20-0x00000000059E0000-0x0000000005F84000-memory.dmp

    Filesize

    5.6MB

  • memory/4812-25-0x00000000053F0000-0x0000000005400000-memory.dmp

    Filesize

    64KB

  • memory/4812-32-0x0000000002E50000-0x0000000002E51000-memory.dmp

    Filesize

    4KB

  • memory/4812-33-0x00000000093E0000-0x0000000009734000-memory.dmp

    Filesize

    3.3MB

  • memory/4812-18-0x0000000000A20000-0x0000000000A98000-memory.dmp

    Filesize

    480KB

  • memory/4812-37-0x0000000009280000-0x000000000928C000-memory.dmp

    Filesize

    48KB

  • memory/4812-21-0x00000000054D0000-0x0000000005562000-memory.dmp

    Filesize

    584KB

  • memory/4812-41-0x0000000009820000-0x00000000098F2000-memory.dmp

    Filesize

    840KB

  • memory/4812-43-0x00000000053F0000-0x0000000005400000-memory.dmp

    Filesize

    64KB