Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
01-03-2024 13:36
Static task
static1
Behavioral task
behavioral1
Sample
TPS V2 Umi Keygen.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
TPS V2 Umi Keygen.exe
Resource
win10v2004-20240226-en
General
-
Target
TPS V2 Umi Keygen.exe
-
Size
1.3MB
-
MD5
cda78cc7005ed4318373322df18e9f1b
-
SHA1
5b32d63c65c9e0c2d500fd6cce90d3c5e5a87b19
-
SHA256
21b9d087307d06d9ca9d92d9a7721429342bf923263f5b5355b2f23650eb2640
-
SHA512
aadee4c2954554cd4599a397635c7f3bb92c428cfd53057913782bc7fcaf4d91bab0cbb574f14ad4f84cf4223ea506a7db5931a2cf7cb2130a6c0e05b770761e
-
SSDEEP
24576:XubsnafAPyjzbmlQQyCqpdh1PfXOrPBuKCnFnnW68B6UpCfh8VzSjBlyq/t/tD:fI3mSQFErnMJujnFnV8B6xh2zYoqNtD
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
TPS V2 Umi Keygen.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation TPS V2 Umi Keygen.exe -
Executes dropped EXE 1 IoCs
Processes:
TPS Tool V3.exepid Process 2664 TPS Tool V3.exe -
Loads dropped DLL 6 IoCs
Processes:
TPS Tool V3.exepid Process 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe -
Obfuscated with Agile.Net obfuscator 2 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral2/files/0x0007000000023224-10.dat agile_net behavioral2/memory/2664-18-0x0000000000B30000-0x0000000000BA8000-memory.dmp agile_net -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
TPS Tool V3.exepid Process 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe 2664 TPS Tool V3.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
TPS Tool V3.exedescription pid Process Token: SeDebugPrivilege 2664 TPS Tool V3.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
TPS V2 Umi Keygen.exedescription pid Process procid_target PID 3956 wrote to memory of 2664 3956 TPS V2 Umi Keygen.exe 89 PID 3956 wrote to memory of 2664 3956 TPS V2 Umi Keygen.exe 89 PID 3956 wrote to memory of 2664 3956 TPS V2 Umi Keygen.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\TPS V2 Umi Keygen.exe"C:\Users\Admin\AppData\Local\Temp\TPS V2 Umi Keygen.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\TPS Tool V3.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\TPS Tool V3.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2664
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21KB
MD581a188ac5da8e396126bbff00430f6f9
SHA1ab98043226e10a53101835cbdb1c0f8068c9ef3a
SHA2566db66509ae09649c059b63d9ca036c7a37dc213ac478ffd03223efb4eec6b922
SHA5124942a7666f7e58b213e2a1da14f3be32d81fbca0f063a5dd775957d8550538e566f654131065e50eda3b0cb931637536fe472cd677f17e7fd8ba5808be0ff059
-
Filesize
430KB
MD5aa307365f26331d9172190d595771601
SHA1f57d8851c804c94578277c32f377ab14f8ab1fa5
SHA2563bdb8e8f053bbf758588c7dc39ecab3bca2152f4d9f20b4ebc5fe52d38592e4a
SHA5123891c7e2f141d1b8ebdad1061b8cbe9f51c5a49cbaace6cae6524d7edffa128285e96d79ba860278b7f37bae81c32e3a32eea89ec1b4436d668f4a3056a34420
-
Filesize
541KB
MD56d1a30cea4ad42edb142dfa44832e108
SHA1e7fb38884f7586236ca6adebd9bb12ebe1784748
SHA2561c38284d7cfb0b7dd09012d9de10e92a1c9ee7a8ea33f6489201a71d80d12457
SHA512ae96a8d9ce586ac83a31d8d381347c28ab1863c138bd1b0ffbe1ac4798bc1358e61bf72bbcf0436dac2a730cb468c1ccc046a64488e02ef775808a23bd3f565d
-
Filesize
433KB
MD5bbf4d1132f017b5e723402caa109c70c
SHA1d91dddbb8b1b2b516d7956b04e57864d4e47c8b0
SHA256037b9e81977a0fbdcebf942f88fdf548c3e9173df5a8fc55236eeefe30ee6fbb
SHA51282249ed7f81a2242ac2846df7835807134fddc8a9e7191b581959bcbca24c725ce6dbce64a7b82d5e6c815273084a2f0a3bf176552c43b3c353812f3cb572e86