Analysis
- max time kernel
142s - max time network
122s - platform
windows7_x64 - resource
win7-20240220-en - resource tags
- submitted
02/03/2024, 22:34
General
- Target Fake AV/LPS2019.exe
- Size 1.1MB
- Sample240302-2g86qsad96
- SHA256 8abed3ea04d52c42bdd6c9169c59212a7d8c649c12006b8278eda5aa91154cd2
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 4 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Drops file in Program Files directory 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 20 IoCs
- Suspicious use of SendNotifyMessage 20 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fake AV\LPS2019.exe"C:\Users\Admin\AppData\Local\Temp\Fake AV\LPS2019.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\HjuTygFcvX\lpsprt.exe"C:\Program Files (x86)\HjuTygFcvX\lpsprt.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
lpsprt.exe
memory/2580-18-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp
memory/2580-19-0x0000000000A10000-0x0000000000A90000-memory.dmp
memory/2580-20-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp
memory/2580-21-0x000000001AFD0000-0x000000001B16C000-memory.dmp
memory/2580-23-0x0000000000A10000-0x0000000000A90000-memory.dmp
memory/2580-22-0x0000000000A10000-0x0000000000A90000-memory.dmp
memory/2580-24-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp
memory/2580-25-0x0000000000A10000-0x0000000000A90000-memory.dmp
memory/2580-26-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp
memory/2580-27-0x0000000000A10000-0x0000000000A90000-memory.dmp
memory/2580-28-0x0000000000A10000-0x0000000000A90000-memory.dmp
memory/2580-29-0x0000000000A10000-0x0000000000A90000-memory.dmp
memory/2580-30-0x0000000000A10000-0x0000000000A90000-memory.dmp