Overview
overview
6Static
static
happytime-...er.exe
windows10-2004-x64
1happytime-...ig.xml
windows10-2004-x64
1happytime-...er.exe
windows10-2004-x64
3happytime-...58.dll
windows10-2004-x64
3happytime-...58.dll
windows10-2004-x64
1happytime-...56.dll
windows10-2004-x64
3happytime-...ig.xml
windows10-2004-x64
1happytime-..._1.dll
windows10-2004-x64
3happytime-..._1.dll
windows10-2004-x64
1happytime-...40.dll
windows10-2004-x64
3happytime-...me.txt
windows10-2004-x64
1happytime-...rt.dll
windows10-2004-x64
3happytime-...ssl.ca
windows10-2004-x64
3happytime-...sl.key
windows10-2004-x64
3happytime-...-3.dll
windows10-2004-x64
1happytime-...-5.dll
windows10-2004-x64
3happytime-...st.mp4
windows10-2004-x64
6happytime-...al.pdf
windows10-2004-x64
1happytime-...40.dll
windows10-2004-x64
3happytime-...pi.dll
windows10-2004-x64
3happytime-...n.html
windows10-2004-x64
1happytime-..._1.dll
windows10-2004-x64
3happytime-..._1.dll
windows10-2004-x64
1happytime-...me.txt
windows10-2004-x64
1happytime-...me.bat
windows10-2004-x64
1happytime-...ot.jpg
windows10-2004-x64
3happytime-...ssl.ca
windows10-2004-x64
3happytime-...sl.key
windows10-2004-x64
3happytime-...al.pdf
windows10-2004-x64
1happytime-...40.dll
windows10-2004-x64
3happytime-...pi.dll
windows10-2004-x64
3Analysis
-
max time kernel
120s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
26-01-2023 03:06
Static task
static1
Behavioral task
behavioral1
Sample
happytime-onvif-server/OnvifServer.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral2
Sample
happytime-onvif-server/config.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
happytime-onvif-server/happytime-rtsp-server/RtspServer.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral4
Sample
happytime-onvif-server/happytime-rtsp-server/avcodec-58.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
happytime-onvif-server/happytime-rtsp-server/avformat-58.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral6
Sample
happytime-onvif-server/happytime-rtsp-server/avutil-56.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
happytime-onvif-server/happytime-rtsp-server/config.xml
Resource
win10v2004-20221111-en
Behavioral task
behavioral8
Sample
happytime-onvif-server/happytime-rtsp-server/libcrypto-1_1.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
happytime-onvif-server/happytime-rtsp-server/libssl-1_1.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral10
Sample
happytime-onvif-server/happytime-rtsp-server/msvcp140.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral11
Sample
happytime-onvif-server/happytime-rtsp-server/readme.txt
Resource
win10v2004-20220812-en
Behavioral task
behavioral12
Sample
happytime-onvif-server/happytime-rtsp-server/srt.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
happytime-onvif-server/happytime-rtsp-server/ssl.ca
Resource
win10v2004-20220901-en
Behavioral task
behavioral14
Sample
happytime-onvif-server/happytime-rtsp-server/ssl.key
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
happytime-onvif-server/happytime-rtsp-server/swresample-3.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral16
Sample
happytime-onvif-server/happytime-rtsp-server/swscale-5.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral17
Sample
happytime-onvif-server/happytime-rtsp-server/test.mp4
Resource
win10v2004-20221111-en
Behavioral task
behavioral18
Sample
happytime-onvif-server/happytime-rtsp-server/user manual.pdf
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
happytime-onvif-server/happytime-rtsp-server/vcruntime140.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral20
Sample
happytime-onvif-server/happytime-rtsp-server/zlibwapi.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
happytime-onvif-server/html/main.html
Resource
win10v2004-20221111-en
Behavioral task
behavioral22
Sample
happytime-onvif-server/libcrypto-1_1.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral23
Sample
happytime-onvif-server/libssl-1_1.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral24
Sample
happytime-onvif-server/readme.txt
Resource
win10v2004-20220901-en
Behavioral task
behavioral25
Sample
happytime-onvif-server/runme.bat
Resource
win10v2004-20220812-en
Behavioral task
behavioral26
Sample
happytime-onvif-server/snapshot.jpg
Resource
win10v2004-20220901-en
Behavioral task
behavioral27
Sample
happytime-onvif-server/ssl.ca
Resource
win10v2004-20220812-en
Behavioral task
behavioral28
Sample
happytime-onvif-server/ssl.key
Resource
win10v2004-20220812-en
Behavioral task
behavioral29
Sample
happytime-onvif-server/user manual.pdf
Resource
win10v2004-20221111-en
Behavioral task
behavioral30
Sample
happytime-onvif-server/vcruntime140.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral31
Sample
happytime-onvif-server/zlibwapi.dll
Resource
win10v2004-20221111-en
General
-
Target
happytime-onvif-server/happytime-rtsp-server/avcodec-58.dll
-
Size
29.6MB
-
MD5
f6e03136925b2115c5bf16c3d350d9ed
-
SHA1
4bbeee92496d3a20f266d297cdb58518bbfe0726
-
SHA256
eed8c8a64549ffdfbc620b4ff6833e58b25d5c1123786c05fbc7be1f12743758
-
SHA512
353008cfff9789986177c718bd6bbdb6184780c0e6b3d8f7f361314a6e8bff116bdbd79e94d8218c0bec73612adac7523876fc4e09e472127dc7947b193882cd
-
SSDEEP
393216:YVbJv2NcGjFg23Xs0qUANf0//O5U0zvhkHxc3gSEkSa0Lpb/GdMX:YbKjHCkO5U0zpkHxcHwYdM
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2440 4676 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4960 wrote to memory of 4676 4960 rundll32.exe rundll32.exe PID 4960 wrote to memory of 4676 4960 rundll32.exe rundll32.exe PID 4960 wrote to memory of 4676 4960 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\happytime-onvif-server\happytime-rtsp-server\avcodec-58.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\happytime-onvif-server\happytime-rtsp-server\avcodec-58.dll,#12⤵PID:4676
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 6363⤵
- Program crash
PID:2440
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4676 -ip 46761⤵PID:1704