Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 19:10
Static task
static1
Behavioral task
behavioral1
Sample
03759d636ca1c9cbf8be0f0f72136b0489919520e2a1db76ce390be049e1530b.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
03759d636ca1c9cbf8be0f0f72136b0489919520e2a1db76ce390be049e1530b.exe
Resource
win10v2004-20241007-en
General
-
Target
03759d636ca1c9cbf8be0f0f72136b0489919520e2a1db76ce390be049e1530b.exe
-
Size
610KB
-
MD5
8a11eadd67a98e89e5c3e999e787dfe2
-
SHA1
2a13461956a496edf0250a17a68361f21ddde691
-
SHA256
03759d636ca1c9cbf8be0f0f72136b0489919520e2a1db76ce390be049e1530b
-
SHA512
0a3cc601cd4352269897b54bab9ee35ecdc7406a8aa49d4e4560b8b159c51e867f629fd2cf0c192d653d5201e0b25c2e28db9f561468244ddc9bcbcd692fd169
-
SSDEEP
12288:AATuTAnKGwUAW3ycQqgYo3CyWoKEY3ZQi7gfqOuuh+c:OT+KjUdQqboyyWoK1NGqzuhb
Malware Config
Signatures
-
Tinba family
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\2E07788B = "C:\\Users\\Admin\\AppData\\Roaming\\2E07788B\\bin.exe" winver.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 03759d636ca1c9cbf8be0f0f72136b0489919520e2a1db76ce390be049e1530b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe -
Suspicious behavior: EnumeratesProcesses 61 IoCs
pid Process 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe 2896 winver.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2896 winver.exe 1160 Explorer.EXE 1160 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1160 Explorer.EXE 1160 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2512 wrote to memory of 2896 2512 03759d636ca1c9cbf8be0f0f72136b0489919520e2a1db76ce390be049e1530b.exe 31 PID 2512 wrote to memory of 2896 2512 03759d636ca1c9cbf8be0f0f72136b0489919520e2a1db76ce390be049e1530b.exe 31 PID 2512 wrote to memory of 2896 2512 03759d636ca1c9cbf8be0f0f72136b0489919520e2a1db76ce390be049e1530b.exe 31 PID 2512 wrote to memory of 2896 2512 03759d636ca1c9cbf8be0f0f72136b0489919520e2a1db76ce390be049e1530b.exe 31 PID 2512 wrote to memory of 2896 2512 03759d636ca1c9cbf8be0f0f72136b0489919520e2a1db76ce390be049e1530b.exe 31 PID 2896 wrote to memory of 1160 2896 winver.exe 21 PID 2896 wrote to memory of 1048 2896 winver.exe 17 PID 2896 wrote to memory of 1080 2896 winver.exe 19 PID 2896 wrote to memory of 1160 2896 winver.exe 21 PID 2896 wrote to memory of 1436 2896 winver.exe 25
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1048
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1080
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\03759d636ca1c9cbf8be0f0f72136b0489919520e2a1db76ce390be049e1530b.exe"C:\Users\Admin\AppData\Local\Temp\03759d636ca1c9cbf8be0f0f72136b0489919520e2a1db76ce390be049e1530b.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2896
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1436