Overview
overview
10Static
static
1TradingVie...12.zip
windows10-1703-x64
1Resource/B...EL.bmp
windows10-1703-x64
10Resource/B...LE.bmp
windows10-1703-x64
4Resource/B...ET.bmp
windows10-1703-x64
4Resource/B...EL.bmp
windows10-1703-x64
4Resource/B...XT.bmp
windows10-1703-x64
4Resource/B...ET.bmp
windows10-1703-x64
4Resource/B...NT.bmp
windows10-1703-x64
4Resource/B...NT.bmp
windows10-1703-x64
4Resource/B...ZY.bmp
windows10-1703-x64
4Resource/B...NT.bmp
windows10-1703-x64
4Resource/B...DE.bmp
windows10-1703-x64
4Resource/B...IP.bmp
windows10-1703-x64
4Resource/B...IP.bmp
windows10-1703-x64
4Resource/B...OW.bmp
windows10-1703-x64
4Resource/B...SH.bmp
windows10-1703-x64
4Resource/B...DE.bmp
windows10-1703-x64
4Resource/B...XT.bmp
windows10-1703-x64
4Resource/B...ID.bmp
windows10-1703-x64
4Resource/B...LE.bmp
windows10-1703-x64
4Resource/B...RN.bmp
windows10-1703-x64
4Resource/B...CH.bmp
windows10-1703-x64
4Resource/B...KE.bmp
windows10-1703-x64
4Resource/B...IG.bmp
windows10-1703-x64
4Resource/B...FT.bmp
windows10-1703-x64
4Resource/B...AD.bmp
windows10-1703-x64
4Resource/B...NE.bmp
windows10-1703-x64
4Resource/B...EF.bmp
windows10-1703-x64
4Resource/B...BR.bmp
windows10-1703-x64
4Resource/userproc.pdf
windows10-1703-x64
1TradingVie...12.exe
windows10-1703-x64
10jvm.dll
windows10-1703-x64
3Analysis
-
max time kernel
172s -
max time network
191s -
platform
windows10-1703_x64 -
resource
win10-20231020-en -
resource tags
arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system -
submitted
01-12-2023 09:23
Static task
static1
Behavioral task
behavioral1
Sample
TradingView analog_v.1.12.zip
Resource
win10-20231020-en
Behavioral task
behavioral2
Sample
Resource/Brushes/BOXPANEL.bmp
Resource
win10-20231023-en
Behavioral task
behavioral3
Sample
Resource/Brushes/BUBBLE.bmp
Resource
win10-20231020-en
Behavioral task
behavioral4
Sample
Resource/Brushes/CIGARET.bmp
Resource
win10-20231020-en
Behavioral task
behavioral5
Sample
Resource/Brushes/CLAMSHEL.bmp
Resource
win10-20231020-en
Behavioral task
behavioral6
Sample
Resource/Brushes/CLAMTEXT.bmp
Resource
win10-20231020-en
Behavioral task
behavioral7
Sample
Resource/Brushes/COMET.bmp
Resource
win10-20231025-en
Behavioral task
behavioral8
Sample
Resource/Brushes/FOOTPRNT.bmp
Resource
win10-20231023-en
Behavioral task
behavioral9
Sample
Resource/Brushes/FRAGMENT.bmp
Resource
win10-20231023-en
Behavioral task
behavioral10
Sample
Resource/Brushes/FUZZY.bmp
Resource
win10-20231025-en
Behavioral task
behavioral11
Sample
Resource/Brushes/GRADIENT.bmp
Resource
win10-20231020-en
Behavioral task
behavioral12
Sample
Resource/Brushes/MANFADE.bmp
Resource
win10-20231020-en
Behavioral task
behavioral13
Sample
Resource/Brushes/MOSCTIP.bmp
Resource
win10-20231023-en
Behavioral task
behavioral14
Sample
Resource/Brushes/OILTIP.bmp
Resource
win10-20231020-en
Behavioral task
behavioral15
Sample
Resource/Brushes/PLUSGLOW.bmp
Resource
win10-20231020-en
Behavioral task
behavioral16
Sample
Resource/Brushes/PNTBRUSH.bmp
Resource
win10-20231023-en
Behavioral task
behavioral17
Sample
Resource/Brushes/PNTWIDE.bmp
Resource
win10-20231020-en
Behavioral task
behavioral18
Sample
Resource/Brushes/PUFFTEXT.bmp
Resource
win10-20231023-en
Behavioral task
behavioral19
Sample
Resource/Brushes/PYRAMID.bmp
Resource
win10-20231020-en
Behavioral task
behavioral20
Sample
Resource/Brushes/RIPPLE.bmp
Resource
win10-20231025-en
Behavioral task
behavioral21
Sample
Resource/Brushes/SATURN.bmp
Resource
win10-20231020-en
Behavioral task
behavioral22
Sample
Resource/Brushes/SCATCH.bmp
Resource
win10-20231020-en
Behavioral task
behavioral23
Sample
Resource/Brushes/SMOKE.bmp
Resource
win10-20231023-en
Behavioral task
behavioral24
Sample
Resource/Brushes/SQUIG.bmp
Resource
win10-20231025-en
Behavioral task
behavioral25
Sample
Resource/Brushes/STARSOFT.bmp
Resource
win10-20231020-en
Behavioral task
behavioral26
Sample
Resource/Brushes/STDGRAD.bmp
Resource
win10-20231020-en
Behavioral task
behavioral27
Sample
Resource/Brushes/STDLINE.bmp
Resource
win10-20231023-en
Behavioral task
behavioral28
Sample
Resource/Brushes/STDLINEF.bmp
Resource
win10-20231020-en
Behavioral task
behavioral29
Sample
Resource/Brushes/STDSPHBR.bmp
Resource
win10-20231020-en
Behavioral task
behavioral30
Sample
Resource/userproc.pdf
Resource
win10-20231023-en
Behavioral task
behavioral31
Sample
TradingView analog_v.1.12.exe
Resource
win10-20231023-en
Behavioral task
behavioral32
Sample
jvm.dll
Resource
win10-20231020-en
General
-
Target
Resource/Brushes/OILTIP.bmp
-
Size
5KB
-
MD5
518983755c1802628ab1166a76fa9359
-
SHA1
69058beafd09e9f604ea041ec52ab52b089e66b9
-
SHA256
54be6847acef6333b4521f7c6dc49a225cc42f51f12cdfe18a2cd73391a78baa
-
SHA512
680384f1f798e129321fe30105cb1242bc620ad7ca69b00ec74f9560a2dc0d5b23546bdb3c106c40928360da9d9856bb20bf4e0e8cdab337163db7d138ef6295
-
SSDEEP
48:tZ353Z3p5JZJP2cOwdhOepKiKz3JkPKVbknhgGLhxqjW17gdGBtbk10utG6WFRYa:75ZZZ5awhgTunrhYjgWkbZuJK27aYS
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
Processes:
mspaint.exedescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
cmd.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings cmd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
mspaint.exepid process 4624 mspaint.exe 4624 mspaint.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
mspaint.exepid process 4624 mspaint.exe 4624 mspaint.exe 4624 mspaint.exe 4624 mspaint.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
cmd.exedescription pid process target process PID 3220 wrote to memory of 4624 3220 cmd.exe mspaint.exe PID 3220 wrote to memory of 4624 3220 cmd.exe mspaint.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Resource\Brushes\OILTIP.bmp1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Resource\Brushes\OILTIP.bmp"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4624
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService1⤵PID:1264