Analysis
-
max time kernel
141s -
max time network
153s -
platform
windows7_x64 -
resource
win7 -
submitted
28-08-2020 13:12
Static task
static1
Behavioral task
behavioral1
Sample
b7f8233dafab45e3abbbb4f3cc76e6860fae8d5337fb0b750ea20058b56b0efb.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
General
-
Target
b7f8233dafab45e3abbbb4f3cc76e6860fae8d5337fb0b750ea20058b56b0efb.exe
-
Size
5.3MB
-
MD5
5308aacaa532afd76767bb6dbece3d10
-
SHA1
31588d24439c386740830ee4d32f9d389bcf6999
-
SHA256
b7f8233dafab45e3abbbb4f3cc76e6860fae8d5337fb0b750ea20058b56b0efb
-
SHA512
0aaaa0862d9b15b9ad423bde6f5edf95f1309924d0645305739004f072a3c2eba6cc66af1892a29af8b8c16424e89ab166b5f23860592f8d72726fe2883e45ee
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 1972 frame.exe 2016 lphsi.exe 2040 hrss.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\script.lnk hrss.exe -
Loads dropped DLL 4 IoCs
pid Process 1768 b7f8233dafab45e3abbbb4f3cc76e6860fae8d5337fb0b750ea20058b56b0efb.exe 1972 frame.exe 1972 frame.exe 2040 hrss.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1988 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1988 vlc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 1988 vlc.exe Token: SeIncBasePriorityPrivilege 1988 vlc.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 1988 vlc.exe 1988 vlc.exe 1988 vlc.exe 1988 vlc.exe 1988 vlc.exe 1988 vlc.exe 1988 vlc.exe 1988 vlc.exe 1988 vlc.exe 1988 vlc.exe 1988 vlc.exe 1988 vlc.exe 1988 vlc.exe 1988 vlc.exe 1988 vlc.exe 1988 vlc.exe 1988 vlc.exe 1988 vlc.exe 1988 vlc.exe 1988 vlc.exe 1988 vlc.exe 1988 vlc.exe 1988 vlc.exe 1988 vlc.exe 1988 vlc.exe 1988 vlc.exe 1988 vlc.exe -
Suspicious use of SendNotifyMessage 7 IoCs
pid Process 1988 vlc.exe 1988 vlc.exe 1988 vlc.exe 1988 vlc.exe 1988 vlc.exe 1988 vlc.exe 1988 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1988 vlc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1768 wrote to memory of 1972 1768 b7f8233dafab45e3abbbb4f3cc76e6860fae8d5337fb0b750ea20058b56b0efb.exe 25 PID 1768 wrote to memory of 1972 1768 b7f8233dafab45e3abbbb4f3cc76e6860fae8d5337fb0b750ea20058b56b0efb.exe 25 PID 1768 wrote to memory of 1972 1768 b7f8233dafab45e3abbbb4f3cc76e6860fae8d5337fb0b750ea20058b56b0efb.exe 25 PID 1768 wrote to memory of 1972 1768 b7f8233dafab45e3abbbb4f3cc76e6860fae8d5337fb0b750ea20058b56b0efb.exe 25 PID 1768 wrote to memory of 1988 1768 b7f8233dafab45e3abbbb4f3cc76e6860fae8d5337fb0b750ea20058b56b0efb.exe 26 PID 1768 wrote to memory of 1988 1768 b7f8233dafab45e3abbbb4f3cc76e6860fae8d5337fb0b750ea20058b56b0efb.exe 26 PID 1768 wrote to memory of 1988 1768 b7f8233dafab45e3abbbb4f3cc76e6860fae8d5337fb0b750ea20058b56b0efb.exe 26 PID 1768 wrote to memory of 1988 1768 b7f8233dafab45e3abbbb4f3cc76e6860fae8d5337fb0b750ea20058b56b0efb.exe 26 PID 1972 wrote to memory of 2016 1972 frame.exe 27 PID 1972 wrote to memory of 2016 1972 frame.exe 27 PID 1972 wrote to memory of 2016 1972 frame.exe 27 PID 1972 wrote to memory of 2016 1972 frame.exe 27 PID 1972 wrote to memory of 2040 1972 frame.exe 28 PID 1972 wrote to memory of 2040 1972 frame.exe 28 PID 1972 wrote to memory of 2040 1972 frame.exe 28 PID 1972 wrote to memory of 2040 1972 frame.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7f8233dafab45e3abbbb4f3cc76e6860fae8d5337fb0b750ea20058b56b0efb.exe"C:\Users\Admin\AppData\Local\Temp\b7f8233dafab45e3abbbb4f3cc76e6860fae8d5337fb0b750ea20058b56b0efb.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Public\Video\frame.exe"C:\Users\Public\Video\frame.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Public\Video\lphsi.exe"C:\Users\Public\Video\lphsi.exe"3⤵
- Executes dropped EXE
PID:2016
-
-
C:\Users\Public\Video\hrss.exe"C:\Users\Public\Video\hrss.exe"3⤵
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
PID:2040
-
-
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Public\Video\movie.mp4"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1988
-