Overview
overview
10Static
static
1TradingVie...12.zip
windows10-1703-x64
1Resource/B...EL.bmp
windows10-1703-x64
10Resource/B...LE.bmp
windows10-1703-x64
4Resource/B...ET.bmp
windows10-1703-x64
4Resource/B...EL.bmp
windows10-1703-x64
4Resource/B...XT.bmp
windows10-1703-x64
4Resource/B...ET.bmp
windows10-1703-x64
4Resource/B...NT.bmp
windows10-1703-x64
4Resource/B...NT.bmp
windows10-1703-x64
4Resource/B...ZY.bmp
windows10-1703-x64
4Resource/B...NT.bmp
windows10-1703-x64
4Resource/B...DE.bmp
windows10-1703-x64
4Resource/B...IP.bmp
windows10-1703-x64
4Resource/B...IP.bmp
windows10-1703-x64
4Resource/B...OW.bmp
windows10-1703-x64
4Resource/B...SH.bmp
windows10-1703-x64
4Resource/B...DE.bmp
windows10-1703-x64
4Resource/B...XT.bmp
windows10-1703-x64
4Resource/B...ID.bmp
windows10-1703-x64
4Resource/B...LE.bmp
windows10-1703-x64
4Resource/B...RN.bmp
windows10-1703-x64
4Resource/B...CH.bmp
windows10-1703-x64
4Resource/B...KE.bmp
windows10-1703-x64
4Resource/B...IG.bmp
windows10-1703-x64
4Resource/B...FT.bmp
windows10-1703-x64
4Resource/B...AD.bmp
windows10-1703-x64
4Resource/B...NE.bmp
windows10-1703-x64
4Resource/B...EF.bmp
windows10-1703-x64
4Resource/B...BR.bmp
windows10-1703-x64
4Resource/userproc.pdf
windows10-1703-x64
1TradingVie...12.exe
windows10-1703-x64
10jvm.dll
windows10-1703-x64
3Analysis
-
max time kernel
168s -
max time network
198s -
platform
windows10-1703_x64 -
resource
win10-20231025-en -
resource tags
arch:x64arch:x86image:win10-20231025-enlocale:en-usos:windows10-1703-x64system -
submitted
01-12-2023 09:23
Static task
static1
Behavioral task
behavioral1
Sample
TradingView analog_v.1.12.zip
Resource
win10-20231020-en
Behavioral task
behavioral2
Sample
Resource/Brushes/BOXPANEL.bmp
Resource
win10-20231023-en
Behavioral task
behavioral3
Sample
Resource/Brushes/BUBBLE.bmp
Resource
win10-20231020-en
Behavioral task
behavioral4
Sample
Resource/Brushes/CIGARET.bmp
Resource
win10-20231020-en
Behavioral task
behavioral5
Sample
Resource/Brushes/CLAMSHEL.bmp
Resource
win10-20231020-en
Behavioral task
behavioral6
Sample
Resource/Brushes/CLAMTEXT.bmp
Resource
win10-20231020-en
Behavioral task
behavioral7
Sample
Resource/Brushes/COMET.bmp
Resource
win10-20231025-en
Behavioral task
behavioral8
Sample
Resource/Brushes/FOOTPRNT.bmp
Resource
win10-20231023-en
Behavioral task
behavioral9
Sample
Resource/Brushes/FRAGMENT.bmp
Resource
win10-20231023-en
Behavioral task
behavioral10
Sample
Resource/Brushes/FUZZY.bmp
Resource
win10-20231025-en
Behavioral task
behavioral11
Sample
Resource/Brushes/GRADIENT.bmp
Resource
win10-20231020-en
Behavioral task
behavioral12
Sample
Resource/Brushes/MANFADE.bmp
Resource
win10-20231020-en
Behavioral task
behavioral13
Sample
Resource/Brushes/MOSCTIP.bmp
Resource
win10-20231023-en
Behavioral task
behavioral14
Sample
Resource/Brushes/OILTIP.bmp
Resource
win10-20231020-en
Behavioral task
behavioral15
Sample
Resource/Brushes/PLUSGLOW.bmp
Resource
win10-20231020-en
Behavioral task
behavioral16
Sample
Resource/Brushes/PNTBRUSH.bmp
Resource
win10-20231023-en
Behavioral task
behavioral17
Sample
Resource/Brushes/PNTWIDE.bmp
Resource
win10-20231020-en
Behavioral task
behavioral18
Sample
Resource/Brushes/PUFFTEXT.bmp
Resource
win10-20231023-en
Behavioral task
behavioral19
Sample
Resource/Brushes/PYRAMID.bmp
Resource
win10-20231020-en
Behavioral task
behavioral20
Sample
Resource/Brushes/RIPPLE.bmp
Resource
win10-20231025-en
Behavioral task
behavioral21
Sample
Resource/Brushes/SATURN.bmp
Resource
win10-20231020-en
Behavioral task
behavioral22
Sample
Resource/Brushes/SCATCH.bmp
Resource
win10-20231020-en
Behavioral task
behavioral23
Sample
Resource/Brushes/SMOKE.bmp
Resource
win10-20231023-en
Behavioral task
behavioral24
Sample
Resource/Brushes/SQUIG.bmp
Resource
win10-20231025-en
Behavioral task
behavioral25
Sample
Resource/Brushes/STARSOFT.bmp
Resource
win10-20231020-en
Behavioral task
behavioral26
Sample
Resource/Brushes/STDGRAD.bmp
Resource
win10-20231020-en
Behavioral task
behavioral27
Sample
Resource/Brushes/STDLINE.bmp
Resource
win10-20231023-en
Behavioral task
behavioral28
Sample
Resource/Brushes/STDLINEF.bmp
Resource
win10-20231020-en
Behavioral task
behavioral29
Sample
Resource/Brushes/STDSPHBR.bmp
Resource
win10-20231020-en
Behavioral task
behavioral30
Sample
Resource/userproc.pdf
Resource
win10-20231023-en
Behavioral task
behavioral31
Sample
TradingView analog_v.1.12.exe
Resource
win10-20231023-en
Behavioral task
behavioral32
Sample
jvm.dll
Resource
win10-20231020-en
General
-
Target
Resource/Brushes/SQUIG.bmp
-
Size
17KB
-
MD5
94ec6f37f19cc6c122eb9183db668c74
-
SHA1
c558996f0fb91c59d3f21d08a587ba7c0cb204ef
-
SHA256
5bfab3a8cb13a08b76ec4eb93c18d100c33ec638414adae64b396e6c9daafef2
-
SHA512
23052d98743a05c40565783eb2ebf6e44b2baa51add59909639ade62bb3914cfe0792387f263e48cc40ad7d16aa04671662697b0a183fef45bc9afe76989c663
-
SSDEEP
384:bvQdo1xZCqVRLD12oslRrh08CNM8blhRXgOSQgmsZCtPksV:bvICzVV4nLm8AlhRXIQ/BV
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
Processes:
mspaint.exedescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
cmd.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2852493121-870915337-2715324265-1000_Classes\Local Settings cmd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
mspaint.exepid process 4580 mspaint.exe 4580 mspaint.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
mspaint.exepid process 4580 mspaint.exe 4580 mspaint.exe 4580 mspaint.exe 4580 mspaint.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
cmd.exedescription pid process target process PID 4172 wrote to memory of 4580 4172 cmd.exe mspaint.exe PID 4172 wrote to memory of 4580 4172 cmd.exe mspaint.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Resource\Brushes\SQUIG.bmp1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Resource\Brushes\SQUIG.bmp"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4580
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService1⤵PID:2300