Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11-12-2024 08:32
Static task
static1
Behavioral task
behavioral1
Sample
567648a0fb5d83f1ad71306f4c6d4935b5f11bf75812de798c6aa4f4b40a3e69N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
567648a0fb5d83f1ad71306f4c6d4935b5f11bf75812de798c6aa4f4b40a3e69N.exe
Resource
win10v2004-20241007-en
General
-
Target
567648a0fb5d83f1ad71306f4c6d4935b5f11bf75812de798c6aa4f4b40a3e69N.exe
-
Size
610KB
-
MD5
83d64b4884029930049caad4d6d50360
-
SHA1
e2a681943f5a750b0d7c7fc917e0363d9b5219c0
-
SHA256
567648a0fb5d83f1ad71306f4c6d4935b5f11bf75812de798c6aa4f4b40a3e69
-
SHA512
ca0a2aa17e2cee4279de842527748ad235e293f43a84205d24ede6fafe04ab400aa9a3375740c7ba7c410aaf7461495fa0cb8b6fdebc7223b6fbd09f05595d35
-
SSDEEP
12288:pATuTAnKGwUAW3ycQqgYo3CyWoKEY3ZQi7gfqOuuh+E:rT+KjUdQqboyyWoK1NGqzuhx
Malware Config
Signatures
-
Tinba family
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\E455D28B = "C:\\Users\\Admin\\AppData\\Roaming\\E455D28B\\bin.exe" winver.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 567648a0fb5d83f1ad71306f4c6d4935b5f11bf75812de798c6aa4f4b40a3e69N.exe -
Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 564 winver.exe 564 winver.exe 564 winver.exe 564 winver.exe 564 winver.exe 564 winver.exe 564 winver.exe 564 winver.exe 564 winver.exe 564 winver.exe 564 winver.exe 564 winver.exe 564 winver.exe 564 winver.exe 564 winver.exe 564 winver.exe 564 winver.exe 564 winver.exe 564 winver.exe 564 winver.exe 564 winver.exe 564 winver.exe 564 winver.exe 564 winver.exe 564 winver.exe 564 winver.exe 564 winver.exe 564 winver.exe 564 winver.exe 564 winver.exe 564 winver.exe 564 winver.exe 564 winver.exe 564 winver.exe 564 winver.exe 564 winver.exe 564 winver.exe 564 winver.exe 564 winver.exe 564 winver.exe 564 winver.exe 564 winver.exe 564 winver.exe 564 winver.exe 564 winver.exe 564 winver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 564 winver.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2092 wrote to memory of 564 2092 567648a0fb5d83f1ad71306f4c6d4935b5f11bf75812de798c6aa4f4b40a3e69N.exe 31 PID 2092 wrote to memory of 564 2092 567648a0fb5d83f1ad71306f4c6d4935b5f11bf75812de798c6aa4f4b40a3e69N.exe 31 PID 2092 wrote to memory of 564 2092 567648a0fb5d83f1ad71306f4c6d4935b5f11bf75812de798c6aa4f4b40a3e69N.exe 31 PID 2092 wrote to memory of 564 2092 567648a0fb5d83f1ad71306f4c6d4935b5f11bf75812de798c6aa4f4b40a3e69N.exe 31 PID 2092 wrote to memory of 564 2092 567648a0fb5d83f1ad71306f4c6d4935b5f11bf75812de798c6aa4f4b40a3e69N.exe 31 PID 564 wrote to memory of 1224 564 winver.exe 21 PID 564 wrote to memory of 1104 564 winver.exe 19 PID 564 wrote to memory of 1172 564 winver.exe 20 PID 564 wrote to memory of 1224 564 winver.exe 21 PID 564 wrote to memory of 1764 564 winver.exe 25 PID 564 wrote to memory of 2092 564 winver.exe 30
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1104
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1172
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\567648a0fb5d83f1ad71306f4c6d4935b5f11bf75812de798c6aa4f4b40a3e69N.exe"C:\Users\Admin\AppData\Local\Temp\567648a0fb5d83f1ad71306f4c6d4935b5f11bf75812de798c6aa4f4b40a3e69N.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:564
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1764