Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
16-12-2024 09:14
Static task
static1
Behavioral task
behavioral1
Sample
5cb67f2fd7cdcd16a79cd33406551d8b344f4b7a97b09b64471bc31bbe467c88N.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
5cb67f2fd7cdcd16a79cd33406551d8b344f4b7a97b09b64471bc31bbe467c88N.exe
Resource
win10v2004-20241007-en
General
-
Target
5cb67f2fd7cdcd16a79cd33406551d8b344f4b7a97b09b64471bc31bbe467c88N.exe
-
Size
225KB
-
MD5
967acfcc4f07a9386491136a7bf121a0
-
SHA1
0c3c9a9d28cdf07e2702cd27a96ee2c5b75e5348
-
SHA256
5cb67f2fd7cdcd16a79cd33406551d8b344f4b7a97b09b64471bc31bbe467c88
-
SHA512
f2de66e2ff8d2dc3ebb77702a8b8dde424ec33283ad8aa428c8fe6ce3c136b8c052509ba63ed78f603cd803553df222dd03ee3506d122f552ad6199677b67c36
-
SSDEEP
6144:qA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpY0:qATuTAnKGwUAW3ycQqgl
Malware Config
Signatures
-
Tinba family
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\CCB9195B = "C:\\Users\\Admin\\AppData\\Roaming\\CCB9195B\\bin.exe" winver.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5cb67f2fd7cdcd16a79cd33406551d8b344f4b7a97b09b64471bc31bbe467c88N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe -
Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 2908 winver.exe 2908 winver.exe 2908 winver.exe 2908 winver.exe 2908 winver.exe 2908 winver.exe 2908 winver.exe 2908 winver.exe 2908 winver.exe 2908 winver.exe 2908 winver.exe 2908 winver.exe 2908 winver.exe 2908 winver.exe 2908 winver.exe 2908 winver.exe 2908 winver.exe 2908 winver.exe 2908 winver.exe 2908 winver.exe 2908 winver.exe 2908 winver.exe 2908 winver.exe 2908 winver.exe 2908 winver.exe 2908 winver.exe 2908 winver.exe 2908 winver.exe 2908 winver.exe 2908 winver.exe 2908 winver.exe 2908 winver.exe 2908 winver.exe 2908 winver.exe 2908 winver.exe 2908 winver.exe 2908 winver.exe 2908 winver.exe 2908 winver.exe 2908 winver.exe 2908 winver.exe 2908 winver.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2908 winver.exe 1388 Explorer.EXE 1388 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1388 Explorer.EXE 1388 Explorer.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2304 wrote to memory of 2908 2304 5cb67f2fd7cdcd16a79cd33406551d8b344f4b7a97b09b64471bc31bbe467c88N.exe 31 PID 2304 wrote to memory of 2908 2304 5cb67f2fd7cdcd16a79cd33406551d8b344f4b7a97b09b64471bc31bbe467c88N.exe 31 PID 2304 wrote to memory of 2908 2304 5cb67f2fd7cdcd16a79cd33406551d8b344f4b7a97b09b64471bc31bbe467c88N.exe 31 PID 2304 wrote to memory of 2908 2304 5cb67f2fd7cdcd16a79cd33406551d8b344f4b7a97b09b64471bc31bbe467c88N.exe 31 PID 2304 wrote to memory of 2908 2304 5cb67f2fd7cdcd16a79cd33406551d8b344f4b7a97b09b64471bc31bbe467c88N.exe 31 PID 2908 wrote to memory of 1388 2908 winver.exe 21 PID 2908 wrote to memory of 1240 2908 winver.exe 19 PID 2908 wrote to memory of 1324 2908 winver.exe 20 PID 2908 wrote to memory of 1388 2908 winver.exe 21 PID 2908 wrote to memory of 1676 2908 winver.exe 23 PID 2908 wrote to memory of 2304 2908 winver.exe 30
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1240
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1324
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\5cb67f2fd7cdcd16a79cd33406551d8b344f4b7a97b09b64471bc31bbe467c88N.exe"C:\Users\Admin\AppData\Local\Temp\5cb67f2fd7cdcd16a79cd33406551d8b344f4b7a97b09b64471bc31bbe467c88N.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2908
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1676