Overview
overview
10Static
static
1TradingVie...12.zip
windows10-1703-x64
1Resource/B...EL.bmp
windows10-1703-x64
10Resource/B...LE.bmp
windows10-1703-x64
4Resource/B...ET.bmp
windows10-1703-x64
4Resource/B...EL.bmp
windows10-1703-x64
4Resource/B...XT.bmp
windows10-1703-x64
4Resource/B...ET.bmp
windows10-1703-x64
4Resource/B...NT.bmp
windows10-1703-x64
4Resource/B...NT.bmp
windows10-1703-x64
4Resource/B...ZY.bmp
windows10-1703-x64
4Resource/B...NT.bmp
windows10-1703-x64
4Resource/B...DE.bmp
windows10-1703-x64
4Resource/B...IP.bmp
windows10-1703-x64
4Resource/B...IP.bmp
windows10-1703-x64
4Resource/B...OW.bmp
windows10-1703-x64
4Resource/B...SH.bmp
windows10-1703-x64
4Resource/B...DE.bmp
windows10-1703-x64
4Resource/B...XT.bmp
windows10-1703-x64
4Resource/B...ID.bmp
windows10-1703-x64
4Resource/B...LE.bmp
windows10-1703-x64
4Resource/B...RN.bmp
windows10-1703-x64
4Resource/B...CH.bmp
windows10-1703-x64
4Resource/B...KE.bmp
windows10-1703-x64
4Resource/B...IG.bmp
windows10-1703-x64
4Resource/B...FT.bmp
windows10-1703-x64
4Resource/B...AD.bmp
windows10-1703-x64
4Resource/B...NE.bmp
windows10-1703-x64
4Resource/B...EF.bmp
windows10-1703-x64
4Resource/B...BR.bmp
windows10-1703-x64
4Resource/userproc.pdf
windows10-1703-x64
1TradingVie...12.exe
windows10-1703-x64
10jvm.dll
windows10-1703-x64
3Analysis
-
max time kernel
102s -
max time network
133s -
platform
windows10-1703_x64 -
resource
win10-20231020-en -
resource tags
arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system -
submitted
01-12-2023 09:23
Static task
static1
Behavioral task
behavioral1
Sample
TradingView analog_v.1.12.zip
Resource
win10-20231020-en
Behavioral task
behavioral2
Sample
Resource/Brushes/BOXPANEL.bmp
Resource
win10-20231023-en
Behavioral task
behavioral3
Sample
Resource/Brushes/BUBBLE.bmp
Resource
win10-20231020-en
Behavioral task
behavioral4
Sample
Resource/Brushes/CIGARET.bmp
Resource
win10-20231020-en
Behavioral task
behavioral5
Sample
Resource/Brushes/CLAMSHEL.bmp
Resource
win10-20231020-en
Behavioral task
behavioral6
Sample
Resource/Brushes/CLAMTEXT.bmp
Resource
win10-20231020-en
Behavioral task
behavioral7
Sample
Resource/Brushes/COMET.bmp
Resource
win10-20231025-en
Behavioral task
behavioral8
Sample
Resource/Brushes/FOOTPRNT.bmp
Resource
win10-20231023-en
Behavioral task
behavioral9
Sample
Resource/Brushes/FRAGMENT.bmp
Resource
win10-20231023-en
Behavioral task
behavioral10
Sample
Resource/Brushes/FUZZY.bmp
Resource
win10-20231025-en
Behavioral task
behavioral11
Sample
Resource/Brushes/GRADIENT.bmp
Resource
win10-20231020-en
Behavioral task
behavioral12
Sample
Resource/Brushes/MANFADE.bmp
Resource
win10-20231020-en
Behavioral task
behavioral13
Sample
Resource/Brushes/MOSCTIP.bmp
Resource
win10-20231023-en
Behavioral task
behavioral14
Sample
Resource/Brushes/OILTIP.bmp
Resource
win10-20231020-en
Behavioral task
behavioral15
Sample
Resource/Brushes/PLUSGLOW.bmp
Resource
win10-20231020-en
Behavioral task
behavioral16
Sample
Resource/Brushes/PNTBRUSH.bmp
Resource
win10-20231023-en
Behavioral task
behavioral17
Sample
Resource/Brushes/PNTWIDE.bmp
Resource
win10-20231020-en
Behavioral task
behavioral18
Sample
Resource/Brushes/PUFFTEXT.bmp
Resource
win10-20231023-en
Behavioral task
behavioral19
Sample
Resource/Brushes/PYRAMID.bmp
Resource
win10-20231020-en
Behavioral task
behavioral20
Sample
Resource/Brushes/RIPPLE.bmp
Resource
win10-20231025-en
Behavioral task
behavioral21
Sample
Resource/Brushes/SATURN.bmp
Resource
win10-20231020-en
Behavioral task
behavioral22
Sample
Resource/Brushes/SCATCH.bmp
Resource
win10-20231020-en
Behavioral task
behavioral23
Sample
Resource/Brushes/SMOKE.bmp
Resource
win10-20231023-en
Behavioral task
behavioral24
Sample
Resource/Brushes/SQUIG.bmp
Resource
win10-20231025-en
Behavioral task
behavioral25
Sample
Resource/Brushes/STARSOFT.bmp
Resource
win10-20231020-en
Behavioral task
behavioral26
Sample
Resource/Brushes/STDGRAD.bmp
Resource
win10-20231020-en
Behavioral task
behavioral27
Sample
Resource/Brushes/STDLINE.bmp
Resource
win10-20231023-en
Behavioral task
behavioral28
Sample
Resource/Brushes/STDLINEF.bmp
Resource
win10-20231020-en
Behavioral task
behavioral29
Sample
Resource/Brushes/STDSPHBR.bmp
Resource
win10-20231020-en
Behavioral task
behavioral30
Sample
Resource/userproc.pdf
Resource
win10-20231023-en
Behavioral task
behavioral31
Sample
TradingView analog_v.1.12.exe
Resource
win10-20231023-en
Behavioral task
behavioral32
Sample
jvm.dll
Resource
win10-20231020-en
General
-
Target
Resource/Brushes/MANFADE.bmp
-
Size
17KB
-
MD5
910b15ea1c73f17be019b9620af424ee
-
SHA1
80c4a6e9a940dc4356a6e27d7be361fb9c53d23c
-
SHA256
3b84071945952749aa4fb88f65e8eb87bedbe6f4a9d7facb6cb9d8e18d91877b
-
SHA512
b53b06b8a326bd64399e76da0991b8ddc3690cdc3de987f822d6a4af950459001537bd0a613382b6699b65b6c57b985222a361fb010bfa6a36aeca7fdbaaea92
-
SSDEEP
192:b5ngUefRXAnU02kw2F5b6uCw9tdSMNIbIjbq:b2XAnUx2b6urbSMNuInq
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
Processes:
mspaint.exedescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
cmd.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings cmd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
mspaint.exepid process 508 mspaint.exe 508 mspaint.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
mspaint.exepid process 508 mspaint.exe 508 mspaint.exe 508 mspaint.exe 508 mspaint.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
cmd.exedescription pid process target process PID 4752 wrote to memory of 508 4752 cmd.exe mspaint.exe PID 4752 wrote to memory of 508 4752 cmd.exe mspaint.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Resource\Brushes\MANFADE.bmp1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Resource\Brushes\MANFADE.bmp"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:508
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService1⤵PID:1324