bb6fd94d088d1205ae5fe6f1b45c3a366490a1286741c0eb71f517997182f2be

Analysis

max time kernel
0s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2024, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PROGRAMFILES/RF_L/tc_un.exe
Size 380KB
Sample240606-ym9snscc32
SHA256 d6eea2ba76205f0e82c46be402ae43d8ec4baa3cc495f0d4bba7fc6366508433
MD5 c47c5c46c60e5ce46d401b4a24d40aca
SHA1 892271c0979073fc194b19933c3f4e8cb5ac0dea
SHA512 3b38eb60dfe61a91db21c5382c63d72a70b26d8cfe02201b384b56b067c32f40c39756b9b34dec389900a94da47ccbb1f32e45c39d01a4c48188a7c020380a8f
SSDEEP 6144:uIkDx9cYLo0ClbGyu+UbyznqpqiY02UecETNv7iWy79fFfVPEGcFiX4:uIy/tyuukqiY02cETN2379fpI
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

evasion trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	tc_un.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	tc_un.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	4956	tc_un.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4956	tc_un.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 2236	4956	tc_un.exe	82
PID 4956 wrote to memory of 2236	4956	tc_un.exe	82
PID 4956 wrote to memory of 2236	4956	tc_un.exe	82

C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\RF_L\tc_un.exe
"C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\RF_L\tc_un.exe"
1⤵
- Checks whether UAC is enabled
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s /u C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\RF_L\tc_OL.dll
  2⤵
  PID:2236
- C:\Windows\Temp\tc_un.exe
  "C:\Windows\Temp\tc_un.exe"
  2⤵
  PID:3012
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\System32\regsvr32.exe" /s /u C:\Windows\Temp\tc_OL.dll
    3⤵
    PID:3996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tc_un.exe

Path C:\Windows\Temp\tc_un.exe
Size 380KB
SHA256 d6eea2ba76205f0e82c46be402ae43d8ec4baa3cc495f0d4bba7fc6366508433
MD5 c47c5c46c60e5ce46d401b4a24d40aca
SHA1 892271c0979073fc194b19933c3f4e8cb5ac0dea
SHA512 3b38eb60dfe61a91db21c5382c63d72a70b26d8cfe02201b384b56b067c32f40c39756b9b34dec389900a94da47ccbb1f32e45c39d01a4c48188a7c020380a8f
SSDEEP 6144:uIkDx9cYLo0ClbGyu+UbyznqpqiY02UecETNv7iWy79fFfVPEGcFiX4:uIy/tyuukqiY02cETN2379fpI
MD5 SHA1 SHA512 SSDEEP

Submit Download

20240606_UnInstall.txt

Path \??\c:\20240606_UnInstall.txt
Size 64B
SHA256 53b2143a9a2f8317b7778bd0ae13b7e5172fe975b9a9f16914c10a945321f0bb
MD5 b6a04056d1115968270eef1681c92b33
SHA1 97a80dadbebb65e05a702538710026c795d3d0e9
SHA512 b67a2d4231e531246b129e1c50852c76ec55da1f4a1533f18816060e149e366e8b1d54f3c3b6b506b40909c41e64b124f1a3f054cc96ed60262d95ac7818d015
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads