Overview

overview

6

Static

static

1

ProtonVPN_v3.0.7.exe

windows7-x64

6

ProtonVPN_v3.0.7.exe

windows10-2004-x64

4

Resubmissions

07-08-2023 14:12

230807-rh5jtsgh6z 10

07-08-2023 14:09

230807-rga9lagh6v 6

07-08-2023 14:03

230807-rcyt4agh5z 4

Analysis

  • max time kernel
    149s
  • max time network
    158s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    07-08-2023 14:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ProtonVPN_v3.0.7.exe

  • Size

    74.2MB

  • MD5

    4205260ed66ce9e31f8c4b6b6ddc0d2f

  • SHA1

    c11fd487094820a0c87399477638a6da56fba6e8

  • SHA256

    2b4ae19913ee3d15751b95d05c1efe794c174e802d0a352fed333c2a6396fd1e

  • SHA512

    976b29a7442f179df10fa23c4b00746097334a63f0e74956c71fca443cf3f0ec282cb7a46759b178d09f46aedc450f11afa62b3219261bf221a20e36d531183b

  • SSDEEP

    1572864:TjIr5oRymmju9NtSokfOYHWoaWa2QtDoGV3TEoUxf:3Ir59KNtSoDm8jFoGVjE3

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1372 --field-trial-handle=1268,i,16466735037322645585,10181305582689765552,131072 /prefetch:2
    1⤵
      PID:2772
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --mojo-platform-channel-handle=3260 --field-trial-handle=1268,i,16466735037322645585,10181305582689765552,131072 /prefetch:1
      1⤵
        PID:2276
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3424 --field-trial-handle=1268,i,16466735037322645585,10181305582689765552,131072 /prefetch:8
        1⤵
          PID:1196
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3544 --field-trial-handle=1268,i,16466735037322645585,10181305582689765552,131072 /prefetch:8
          1⤵
            PID:2204
          • C:\Users\Admin\AppData\Local\Temp\ProtonVPN_v3.0.7.exe
            "C:\Users\Admin\AppData\Local\Temp\ProtonVPN_v3.0.7.exe"
            1⤵
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:1040
            • C:\Users\Admin\AppData\Local\Temp\is-SUDHM.tmp\ProtonVPN_v3.0.7.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-SUDHM.tmp\ProtonVPN_v3.0.7.tmp" /SL5="$30184,76841621,1089536,C:\Users\Admin\AppData\Local\Temp\ProtonVPN_v3.0.7.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious behavior: GetForegroundWindowSpam
              PID:344
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3816 --field-trial-handle=1268,i,16466735037322645585,10181305582689765552,131072 /prefetch:8
            1⤵
              PID:112
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=1848 --field-trial-handle=1268,i,16466735037322645585,10181305582689765552,131072 /prefetch:1
              1⤵
                PID:804
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --mojo-platform-channel-handle=3412 --field-trial-handle=1268,i,16466735037322645585,10181305582689765552,131072 /prefetch:1
                1⤵
                  PID:776
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2552 --field-trial-handle=1268,i,16466735037322645585,10181305582689765552,131072 /prefetch:8
                  1⤵
                    PID:1964
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=1268,i,16466735037322645585,10181305582689765552,131072 /prefetch:8
                    1⤵
                      PID:896
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3316 --field-trial-handle=1268,i,16466735037322645585,10181305582689765552,131072 /prefetch:8
                      1⤵
                        PID:2504
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=3976 --field-trial-handle=1268,i,16466735037322645585,10181305582689765552,131072 /prefetch:1
                        1⤵
                          PID:1880
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=3400 --field-trial-handle=1268,i,16466735037322645585,10181305582689765552,131072 /prefetch:1
                          1⤵
                            PID:2604

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Temp\is-SUDHM.tmp\ProtonVPN_v3.0.7.tmp
                            Filesize

                            3.3MB

                            MD5

                            49ae5a0ec56b59f2ebffae7f37491fd7

                            SHA1

                            3c039d124392560762b0bb56dc5da58b3d3a27d5

                            SHA256

                            d4895ce6cbe8326b9cd1d25fd01b439ec01efbdf87dec4553e4902d0dc06c0e3

                            SHA512

                            3c451bda12e87ba3ff674c79ba0dbc38c98a97551833807b84a0cf4b659fc4ce92f270903f32edc0bcc343fa64ebbb00a2246e47795e32a71b3db65aeee77fde

                            Download Submit

                          • \Users\Admin\AppData\Local\Temp\is-SUDHM.tmp\ProtonVPN_v3.0.7.tmp
                            Filesize

                            3.3MB

                            MD5

                            49ae5a0ec56b59f2ebffae7f37491fd7

                            SHA1

                            3c039d124392560762b0bb56dc5da58b3d3a27d5

                            SHA256

                            d4895ce6cbe8326b9cd1d25fd01b439ec01efbdf87dec4553e4902d0dc06c0e3

                            SHA512

                            3c451bda12e87ba3ff674c79ba0dbc38c98a97551833807b84a0cf4b659fc4ce92f270903f32edc0bcc343fa64ebbb00a2246e47795e32a71b3db65aeee77fde

                            Download Submit

                          • memory/344-61-0x00000000001D0000-0x00000000001D1000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/344-63-0x0000000000400000-0x0000000000752000-memory.dmp

                            Filesize

                            3.3MB

                            Download

                          • memory/344-64-0x00000000001D0000-0x00000000001D1000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/1040-54-0x0000000000400000-0x0000000000517000-memory.dmp

                            Filesize

                            1.1MB

                            Download

                          • memory/1040-62-0x0000000000400000-0x0000000000517000-memory.dmp

                            Filesize

                            1.1MB

                            Download