Analysis
-
max time kernel
121s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/09/2024, 13:03
Static task
static1
Behavioral task
behavioral1
Sample
tcpeye-network-tools-1-0-en.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
tcpeye-network-tools-1-0-en.exe
-
Size
1.4MB
-
MD5
219c77d51c1887254bf9d2e5663b1817
-
SHA1
bd3f3e3ccddca7ef029048dde9bf87d783a021cf
-
SHA256
21e1046ff6989cad67d9d3bfc49011f63d81f8c4c89d54ae318a110ec14a9a2e
-
SHA512
447cee5ba69d7132e77fad235f02244f70ef6d057d86ecf76eca572d1d72ced5d1459b89d1b683c3ce689de34da1bfc83b0e4fa738190d5f6717ff3aac2e282c
-
SSDEEP
24576:L20kG3HzuXRQAkhUEkbjlA1WScxlk1U8VEQMnQm/BrUU/rpI2anlMvgY7rmvZf5A:L2U3TuaAkhURHlW8YUlptBrUI9gnlMIE
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3380 tcpeye-network-tools-1-0-en.tmp 512 TCPEye.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 7 IoCs
description ioc Process File created C:\Program Files (x86)\TCPEye\unins000.dat tcpeye-network-tools-1-0-en.tmp File created C:\Program Files (x86)\TCPEye\is-IKA2P.tmp tcpeye-network-tools-1-0-en.tmp File created C:\Program Files (x86)\TCPEye\is-EC13S.tmp tcpeye-network-tools-1-0-en.tmp File created C:\Program Files (x86)\TCPEye\is-3IJ9I.tmp tcpeye-network-tools-1-0-en.tmp File created C:\Program Files (x86)\TCPEye\is-5BH77.tmp tcpeye-network-tools-1-0-en.tmp File created C:\Program Files (x86)\TCPEye\is-T9U1N.tmp tcpeye-network-tools-1-0-en.tmp File opened for modification C:\Program Files (x86)\TCPEye\unins000.dat tcpeye-network-tools-1-0-en.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tcpeye-network-tools-1-0-en.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tcpeye-network-tools-1-0-en.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TCPEye.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 512 TCPEye.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeDebugPrivilege 512 TCPEye.exe Token: SeDebugPrivilege 512 TCPEye.exe Token: SeDebugPrivilege 512 TCPEye.exe Token: SeDebugPrivilege 512 TCPEye.exe Token: SeDebugPrivilege 512 TCPEye.exe Token: SeDebugPrivilege 512 TCPEye.exe Token: SeDebugPrivilege 512 TCPEye.exe Token: SeDebugPrivilege 512 TCPEye.exe Token: SeDebugPrivilege 512 TCPEye.exe Token: SeDebugPrivilege 512 TCPEye.exe Token: SeDebugPrivilege 512 TCPEye.exe Token: SeDebugPrivilege 512 TCPEye.exe Token: SeDebugPrivilege 512 TCPEye.exe Token: SeDebugPrivilege 512 TCPEye.exe Token: SeDebugPrivilege 512 TCPEye.exe Token: SeDebugPrivilege 512 TCPEye.exe Token: SeDebugPrivilege 512 TCPEye.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
pid Process 3380 tcpeye-network-tools-1-0-en.tmp 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe -
Suspicious use of SendNotifyMessage 27 IoCs
pid Process 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe 512 TCPEye.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 512 TCPEye.exe 512 TCPEye.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 64 wrote to memory of 3380 64 tcpeye-network-tools-1-0-en.exe 84 PID 64 wrote to memory of 3380 64 tcpeye-network-tools-1-0-en.exe 84 PID 64 wrote to memory of 3380 64 tcpeye-network-tools-1-0-en.exe 84 PID 3380 wrote to memory of 512 3380 tcpeye-network-tools-1-0-en.tmp 99 PID 3380 wrote to memory of 512 3380 tcpeye-network-tools-1-0-en.tmp 99 PID 3380 wrote to memory of 512 3380 tcpeye-network-tools-1-0-en.tmp 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\tcpeye-network-tools-1-0-en.exe"C:\Users\Admin\AppData\Local\Temp\tcpeye-network-tools-1-0-en.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Users\Admin\AppData\Local\Temp\is-JTKE6.tmp\tcpeye-network-tools-1-0-en.tmp"C:\Users\Admin\AppData\Local\Temp\is-JTKE6.tmp\tcpeye-network-tools-1-0-en.tmp" /SL5="$50282,1150932,54272,C:\Users\Admin\AppData\Local\Temp\tcpeye-network-tools-1-0-en.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Program Files (x86)\TCPEye\TCPEye.exe"C:\Program Files (x86)\TCPEye\TCPEye.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:512
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.3MB
MD5363fa87557453cae312962934a7f584b
SHA10205c15031eb6f868ac96e00f28c60b4c17f8930
SHA2561016e96b262dfddf97b521c16fce6985663b5ca6c0194e04ecbf243b9504133f
SHA51277c67e1f8ff9ee9f40bb7c4b53cb75a153eebf8bc292d70dcb1446dec6a7c914a4b8cc075670ee0649bf87d7d681156c7844e8921b991a6b7aae3a863b76007c
-
Filesize
890KB
MD5c626609d7b17845dcfce715840e0e115
SHA13def8b4917bc67dcabdc52d8040ee14e42a02fde
SHA25625e38176d0bf30bcb47021103afe15b84c0af9153aa15753716587146679e391
SHA5126ebb4820fe1a1f3780c6cae73a7b6bb2d2b9004c0d2dde4df57a883fe27800466548491375886f24a40db383428e9837532ed185aa0c7982205e91fc74f74c1b
-
Filesize
680KB
MD5e60a74a65005e4c4f61cbe9c09d368df
SHA11d649b2ab5e08632d64e23f5f9e5675b68e184b4
SHA25678f6692d50d07bd78a97294d196f9ae7d1fc48b058375e5d7bb766970faab758
SHA512a73b84739f4da0827976cf473e63ba3dc7649ab2d37be13c8fb786487d0dc7ef5b2bd446d8c745d75266447357bde4f32f58f1f1c92b156f06f141fea2873856