Overview

overview

7

Static

static

3

TMACv6.0.7_Setup.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    32s
  • max time network
    40s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    09/10/2024, 20:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    TMACv6.0.7_Setup.exe

  • Size

    5.1MB

  • MD5

    a7c8cf1d50ebe630a7d0c47686a0abbf

  • SHA1

    3229e8080975f4f5512d2382552f68c0389acff5

  • SHA256

    a453b3ea8d8133531fad26b18701c694c324cc201e3069d07e99f0e100908c1a

  • SHA512

    42340b7435605049e3f817feac1ac238177772b2b1ebf05eb9311bb58ee3dd1cab39913240a4c39e3407374009310770d8221c31914549524ecd92beab93b787

  • SSDEEP

    98304:ARU3j4wtopcj2dqCYV1coZ4hv3tmF1b6CrjfW/sfH6s7zQcKDsVv/JLSF66b/:ARqt/CdqRc64hv3tmF1b6CffW/sfH6sm

Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 14 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 13 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 48 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious use of FindShellTrayWindow 32 IoCs
  • Suspicious use of SendNotifyMessage 30 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TMACv6.0.7_Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\TMACv6.0.7_Setup.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:124
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\system32\MSCOMCTL.OCX"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies registry class
      PID:4744
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\system32\COMDLG32.OCX"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:4732
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\system32\MSCHRT20.OCX"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:3848
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\system32\TABCTL32.OCX"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:3464
  • C:\Program Files (x86)\Technitium\TMACv6.0\TMAC.exe
    "C:\Program Files (x86)\Technitium\TMACv6.0\TMAC.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:4336

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Technitium\TMACv6.0\Default.tpf
          Filesize

          327B

          MD5

          b15b6771957a32ad93ffd0e044e4dca7

          SHA1

          1fc37282fce391d607c71dccbaba0fea8ae0f68b

          SHA256

          29106fa8e3c3d9370ced3d1c18f6d99a139710d6f77c8e61d468934dbd7efeeb

          SHA512

          49f28ac07e41de4cca37fcd6a898f1ba90766b3387bd49f171a1c49d75b7f94eb84b2d08e9efacc9a3281091413d8f19a06feb55825756ed533084565afccc5b

          Download Submit

        • C:\Program Files (x86)\Technitium\TMACv6.0\Installer.exe
          Filesize

          189KB

          MD5

          9473840ec1c2981e805da17c0b700c49

          SHA1

          fdd826931c215717861254b099dba057b740e242

          SHA256

          00cb5fee0ba2ac509195187df7d97d9ff08ffcb7df2a3af076a739e0c29781f4

          SHA512

          8ba9ef5cc94e75d48aaa1440ae45841a4b002c5a64584b6a6dd7e4bc2f0ede8d576537d8f14dfd2d76f6e2f6de847102ec4f6755d4a1314b4dd891919ee8cce9

          Download Submit

        • C:\Program Files (x86)\Technitium\TMACv6.0\TMAC.exe
          Filesize

          712KB

          MD5

          230b4c45774e95dd75241068c68aeb0d

          SHA1

          ef46dd76a8c6d4a7d6882469015a07a9bf660a50

          SHA256

          6c3d76c9a4d1652ce25ae8c2ba1907167cfaa0054b8e1325f370c52eafa74c97

          SHA512

          fc08d219e1023d7929250ecab81f640e4114f51b184d9004da0887c93b24a6026931a71da4ef0e95caa2a416d858496b5e174bcd0dd3bd3a76bca6582283e90c

          Download Submit

        • C:\Program Files (x86)\Technitium\TMACv6.0\oui.db
          Filesize

          1.9MB

          MD5

          df01b5d254a5975ab617cf11d1c31fe1

          SHA1

          0fd90aee6d7a9b7417db574d9af5046fac45e14d

          SHA256

          eb13aff91a8ee50dfdf7b2cbf10e0e975f6d6111298737ab051539a4b9156944

          SHA512

          f6d1bfbb6793926c518b2a36f5fc46767d5fa508ee6f2973718ec8b8ae3e93d04f7d66c28c15aad1697d3bd81f4af7358dab9c4a56e95e85743ae7c6bf01f7c4

          Download Submit

        • C:\Windows\SysWOW64\COMDLG32.OCX
          Filesize

          137KB

          MD5

          b73809a916e6d7c1ae56f182a2e8f7e2

          SHA1

          34e4213d8bf0e150d3f50ae0bd3f5b328e1105f5

          SHA256

          64c6ee999562961d11af130254ad3ffd24bb725d3c18e7877f9fd362f4936195

          SHA512

          26c28cb6c7e1b47425403ab8850a765ac420dd6474327ce8469376219c830ab46218383d15a73c9ea3a23fc6b5f392ee6e2a1632a1bf644b1bd1a05a4729e333

          Download Submit

        • C:\Windows\SysWOW64\MSCHRT20.OCX
          Filesize

          987KB

          MD5

          38ce0c8fcd78d00fd717ce3a91214cbc

          SHA1

          953b182806a8ddcde48b033537e3432a56d1cf39

          SHA256

          de49eb9f935416cc57a1b590cca686e4a14e7b3cbbde10b8ff7fb88642a215ce

          SHA512

          bd7c0319953c5280d1e0f961cd6324c70c4949c0db0aa1cd77c27a8a1abfd6e592164a8888e3a06b5b127614d9b9caf1dfcae95b9e50216547a8e8ffb1f00006

          Download Submit

        • C:\Windows\SysWOW64\MSCOMCTL.OCX
          Filesize

          1.0MB

          MD5

          766f501b61c22723536af696a74133d4

          SHA1

          b82b79c981da0750566cdbcccd8c7c6183e75d1b

          SHA256

          793fca37e1848495affb9bfbad543609d19e6549181e735ceb6f97b8e58faa26

          SHA512

          84a10cb82f1e52fbc74d074cf9d8bf761425d69fe893851d490cbf466ae647fa0cd3849ea81356a3ff1c91b67c0834ff59a6f67eddc3267c68f88667ef42fb83

          Download Submit

        • C:\Windows\SysWOW64\TABCTL32.OCX
          Filesize

          218KB

          MD5

          dc925b6d77ba9ecb532e2f6750be943b

          SHA1

          f71215e701401f0dd6fe143e3a630b2e168a4fac

          SHA256

          d10a197fd53e65dc910ca4aed86cb674c613ff14ce6436d1a445bb27a7a499e0

          SHA512

          ee9c40e695a29de7e7b8a9fe1ca01ebba9a8bdc199d46d98c71a4e3ecfec566f2fc31300a5e9867e8c791b15ac3ebec076f0710e0f6eec6c3fdea3bde37ab171

          Download Submit