Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01-03-2024 13:36
Static task
static1
Behavioral task
behavioral1
Sample
TPS V2 Umi Keygen.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
TPS V2 Umi Keygen.exe
Resource
win10v2004-20240226-en
General
-
Target
TPS V2 Umi Keygen.exe
-
Size
1.3MB
-
MD5
cda78cc7005ed4318373322df18e9f1b
-
SHA1
5b32d63c65c9e0c2d500fd6cce90d3c5e5a87b19
-
SHA256
21b9d087307d06d9ca9d92d9a7721429342bf923263f5b5355b2f23650eb2640
-
SHA512
aadee4c2954554cd4599a397635c7f3bb92c428cfd53057913782bc7fcaf4d91bab0cbb574f14ad4f84cf4223ea506a7db5931a2cf7cb2130a6c0e05b770761e
-
SSDEEP
24576:XubsnafAPyjzbmlQQyCqpdh1PfXOrPBuKCnFnnW68B6UpCfh8VzSjBlyq/t/tD:fI3mSQFErnMJujnFnV8B6xh2zYoqNtD
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
TPS Tool V3.exepid Process 2632 TPS Tool V3.exe -
Loads dropped DLL 9 IoCs
Processes:
TPS V2 Umi Keygen.exeWerFault.exepid Process 2656 TPS V2 Umi Keygen.exe 2656 TPS V2 Umi Keygen.exe 2656 TPS V2 Umi Keygen.exe 2656 TPS V2 Umi Keygen.exe 2580 WerFault.exe 2580 WerFault.exe 2580 WerFault.exe 2580 WerFault.exe 2580 WerFault.exe -
Obfuscated with Agile.Net obfuscator 2 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/files/0x002a000000014b6d-9.dat agile_net behavioral1/memory/2632-22-0x0000000001100000-0x0000000001178000-memory.dmp agile_net -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 2580 2632 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
TPS V2 Umi Keygen.exeTPS Tool V3.exedescription pid Process procid_target PID 2656 wrote to memory of 2632 2656 TPS V2 Umi Keygen.exe 28 PID 2656 wrote to memory of 2632 2656 TPS V2 Umi Keygen.exe 28 PID 2656 wrote to memory of 2632 2656 TPS V2 Umi Keygen.exe 28 PID 2656 wrote to memory of 2632 2656 TPS V2 Umi Keygen.exe 28 PID 2632 wrote to memory of 2580 2632 TPS Tool V3.exe 30 PID 2632 wrote to memory of 2580 2632 TPS Tool V3.exe 30 PID 2632 wrote to memory of 2580 2632 TPS Tool V3.exe 30 PID 2632 wrote to memory of 2580 2632 TPS Tool V3.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\TPS V2 Umi Keygen.exe"C:\Users\Admin\AppData\Local\Temp\TPS V2 Umi Keygen.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\TPS Tool V3.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\TPS Tool V3.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 7803⤵
- Loads dropped DLL
- Program crash
PID:2580
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
430KB
MD5aa307365f26331d9172190d595771601
SHA1f57d8851c804c94578277c32f377ab14f8ab1fa5
SHA2563bdb8e8f053bbf758588c7dc39ecab3bca2152f4d9f20b4ebc5fe52d38592e4a
SHA5123891c7e2f141d1b8ebdad1061b8cbe9f51c5a49cbaace6cae6524d7edffa128285e96d79ba860278b7f37bae81c32e3a32eea89ec1b4436d668f4a3056a34420