Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
15-12-2024 11:16
Static task
static1
Behavioral task
behavioral1
Sample
12,27,58 27-07-2015 voice.wav.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
12,27,58 27-07-2015 voice.wav.exe
Resource
win10v2004-20241007-en
General
-
Target
12,27,58 27-07-2015 voice.wav.exe
-
Size
100KB
-
MD5
8af1ac4476bd48388fd690c6bdf82eb8
-
SHA1
9541efff429a869992c046a81d4a04842835e1ce
-
SHA256
d445d97c79e6578a194e85619ab0183d930ac4041b73210582f04b4a6d6300ad
-
SHA512
dd735d40f46236d0d5805347f107c3f276b60154735537faf9f82f20a9f2d2d6d28db08e0894ed3a810c484d9d18fedaa55da050de5af9c577deb63d3d020e1e
-
SSDEEP
1536:YryIOzqdHP1HDYObBAG88zff0B/xDy9Qq/dU1+K975AnpUH/rT6Ic:QzdHF3lacn0BJoQGUQKDgp0/36z
Malware Config
Signatures
-
Tinba family
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\AC6E1944 = "C:\\Users\\Admin\\AppData\\Roaming\\AC6E1944\\bin.exe" EXPLORER.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2536 set thread context of 2772 2536 12,27,58 27-07-2015 voice.wav.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12,27,58 27-07-2015 voice.wav.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXPLORER.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12,27,58 27-07-2015 voice.wav.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2536 12,27,58 27-07-2015 voice.wav.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe 2300 EXPLORER.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2536 12,27,58 27-07-2015 voice.wav.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2536 wrote to memory of 2772 2536 12,27,58 27-07-2015 voice.wav.exe 30 PID 2536 wrote to memory of 2772 2536 12,27,58 27-07-2015 voice.wav.exe 30 PID 2536 wrote to memory of 2772 2536 12,27,58 27-07-2015 voice.wav.exe 30 PID 2536 wrote to memory of 2772 2536 12,27,58 27-07-2015 voice.wav.exe 30 PID 2536 wrote to memory of 2772 2536 12,27,58 27-07-2015 voice.wav.exe 30 PID 2536 wrote to memory of 2772 2536 12,27,58 27-07-2015 voice.wav.exe 30 PID 2536 wrote to memory of 2772 2536 12,27,58 27-07-2015 voice.wav.exe 30 PID 2536 wrote to memory of 2772 2536 12,27,58 27-07-2015 voice.wav.exe 30 PID 2772 wrote to memory of 2300 2772 12,27,58 27-07-2015 voice.wav.exe 31 PID 2772 wrote to memory of 2300 2772 12,27,58 27-07-2015 voice.wav.exe 31 PID 2772 wrote to memory of 2300 2772 12,27,58 27-07-2015 voice.wav.exe 31 PID 2772 wrote to memory of 2300 2772 12,27,58 27-07-2015 voice.wav.exe 31 PID 2772 wrote to memory of 2300 2772 12,27,58 27-07-2015 voice.wav.exe 31 PID 2300 wrote to memory of 1128 2300 EXPLORER.exe 19 PID 2300 wrote to memory of 1204 2300 EXPLORER.exe 20 PID 2300 wrote to memory of 1256 2300 EXPLORER.exe 21 PID 2300 wrote to memory of 1092 2300 EXPLORER.exe 25
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1128
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1204
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\12,27,58 27-07-2015 voice.wav.exe"C:\Users\Admin\AppData\Local\Temp\12,27,58 27-07-2015 voice.wav.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\12,27,58 27-07-2015 voice.wav.exe"C:\Users\Admin\AppData\Local\Temp\12,27,58 27-07-2015 voice.wav.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\EXPLORER.exeEXPLORER4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2300
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1092