d2dbebaf7d20189a83c281bbab6cce71b8eb7859c09b8b09b3ebb23740dca1bb

Analysis

max time kernel
142s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/04/2024, 03:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TYFrame.exe
Size

975KB
MD5

37a235ee25885b7d32f6e4758d97744f
SHA1

5f5365cb021169bab2e48c7e76f3f685b59bd4b8
SHA256

6554d3cdf92be4afb113c63ac57b0bf64f654b66ad7a881671b33ae523443830
SHA512

3102ac259141305de855b42c704f494cbca8dd651dcb67a2820a53fa83012bf81bf29958760b5c7ff6634072e12ca112cc5a9b69a40a2c328da5a4ca17c92cc5
SSDEEP

12288:WMpMLAkwN5VMsXtmzx/2ALo1/iEutcsY0whF6f7dnw40Yidsbf64bOJa88xsv1:HaAbzVp9mz2jdOwrsfBc/4bOQ88M1

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2804	tyframe.exe

Loads dropped DLL 5 IoCs

pid	Process
2276	update.exe
2276	update.exe
2804	tyframe.exe
2804	tyframe.exe
2804	tyframe.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2804	tyframe.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2276	update.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2944	TYFrame.exe
2944	TYFrame.exe
2804	tyframe.exe
2804	tyframe.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2944	TYFrame.exe
2944	TYFrame.exe
2804	tyframe.exe
2804	tyframe.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2276	2944	TYFrame.exe	28
PID 2944 wrote to memory of 2276	2944	TYFrame.exe	28
PID 2944 wrote to memory of 2276	2944	TYFrame.exe	28
PID 2944 wrote to memory of 2276	2944	TYFrame.exe	28
PID 2944 wrote to memory of 2276	2944	TYFrame.exe	28
PID 2944 wrote to memory of 2276	2944	TYFrame.exe	28
PID 2944 wrote to memory of 2276	2944	TYFrame.exe	28
PID 2276 wrote to memory of 2804	2276	update.exe	29
PID 2276 wrote to memory of 2804	2276	update.exe	29
PID 2276 wrote to memory of 2804	2276	update.exe	29
PID 2276 wrote to memory of 2804	2276	update.exe	29
PID 2276 wrote to memory of 2804	2276	update.exe	29
PID 2276 wrote to memory of 2804	2276	update.exe	29
PID 2276 wrote to memory of 2804	2276	update.exe	29

C:\Users\Admin\AppData\Local\Temp\TYFrame.exe
"C:\Users\Admin\AppData\Local\Temp\TYFrame.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Users\Admin\AppData\Local\Temp\update.exe
  C:\Users\Admin\AppData\Local\Temp\update.exe tyframe.exe restart
  2⤵
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Users\Admin\AppData\Local\Temp\tyframe.exe
    C:\Users\Admin\AppData\Local\Temp\tyframe.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\TYFrame.exe

Filesize
981KB

MD5
d6f79d061aa638dd20f1ded12d8447ad

SHA1
7263ac01813bac63e87457fc9f28f52defb3b6a6

SHA256
12d2a55d16c7bf1c4b07712a2c80cc78d168af227d73fd0f70c009e0a1af19f0

SHA512
9927fc0e72a3041d63ce768fd095ed79d0c9379eb6a96136554d000d8982a2fc183ffba1563f163aa18318acd07e163a0d61fc285719c4eab72b5503b48c2ba2

Download Submit
memory/2276-68-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/2276-58-0x0000000003370000-0x00000000035F8000-memory.dmp

Filesize
2.5MB

Download
memory/2276-53-0x0000000003370000-0x00000000035F8000-memory.dmp

Filesize
2.5MB

Download
memory/2804-64-0x0000000002E60000-0x0000000002E62000-memory.dmp

Filesize
8KB

Download
memory/2804-65-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/2804-70-0x0000000000400000-0x0000000000688000-memory.dmp

Filesize
2.5MB

Download
memory/2804-69-0x0000000000400000-0x0000000000688000-memory.dmp

Filesize
2.5MB

Download
memory/2804-72-0x0000000000E00000-0x0000000001088000-memory.dmp

Filesize
2.5MB

Download
memory/2804-73-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/2804-74-0x0000000000E00000-0x0000000001088000-memory.dmp

Filesize
2.5MB

Download
memory/2804-71-0x0000000000E00000-0x0000000001088000-memory.dmp

Filesize
2.5MB

Download
memory/2804-66-0x0000000000E00000-0x0000000001088000-memory.dmp

Filesize
2.5MB

Download
memory/2804-67-0x0000000002E70000-0x0000000002E72000-memory.dmp

Filesize
8KB

Download
memory/2804-62-0x0000000000400000-0x0000000000688000-memory.dmp

Filesize
2.5MB

Download
memory/2804-63-0x0000000000390000-0x00000000003DB000-memory.dmp

Filesize
300KB

Download
memory/2804-61-0x0000000000E00000-0x0000000001088000-memory.dmp

Filesize
2.5MB

Download
memory/2804-60-0x0000000000E00000-0x0000000001088000-memory.dmp

Filesize
2.5MB

Download
memory/2804-59-0x0000000000400000-0x0000000000688000-memory.dmp

Filesize
2.5MB

Download
memory/2804-75-0x0000000000400000-0x0000000000688000-memory.dmp

Filesize
2.5MB

Download
memory/2944-37-0x0000000002990000-0x0000000002991000-memory.dmp

Filesize
4KB

Download
memory/2944-41-0x0000000000400000-0x0000000000685000-memory.dmp

Filesize
2.5MB

Download
memory/2944-31-0x00000000029D0000-0x00000000029D1000-memory.dmp

Filesize
4KB

Download
memory/2944-29-0x00000000029F0000-0x0000000002AF0000-memory.dmp

Filesize
1024KB

Download
memory/2944-27-0x0000000002950000-0x0000000002952000-memory.dmp

Filesize
8KB

Download
memory/2944-26-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2944-25-0x0000000000A20000-0x0000000000A21000-memory.dmp

Filesize
4KB

Download
memory/2944-24-0x0000000000A00000-0x0000000000A01000-memory.dmp

Filesize
4KB

Download
memory/2944-23-0x00000000021B0000-0x00000000021B1000-memory.dmp

Filesize
4KB

Download
memory/2944-22-0x00000000021E0000-0x00000000021E1000-memory.dmp

Filesize
4KB

Download
memory/2944-21-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/2944-20-0x0000000000A40000-0x0000000000A41000-memory.dmp

Filesize
4KB

Download
memory/2944-19-0x00000000021D0000-0x00000000021D1000-memory.dmp

Filesize
4KB

Download
memory/2944-18-0x00000000007B0000-0x00000000007B1000-memory.dmp

Filesize
4KB

Download
memory/2944-17-0x00000000009C0000-0x00000000009C1000-memory.dmp

Filesize
4KB

Download
memory/2944-16-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/2944-15-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2944-14-0x00000000007C0000-0x00000000007C1000-memory.dmp

Filesize
4KB

Download
memory/2944-13-0x00000000007A0000-0x00000000007A1000-memory.dmp

Filesize
4KB

Download
memory/2944-39-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download
memory/2944-40-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/2944-32-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2944-42-0x0000000000400000-0x0000000000685000-memory.dmp

Filesize
2.5MB

Download
memory/2944-43-0x00000000002B0000-0x00000000002FB000-memory.dmp

Filesize
300KB

Download
memory/2944-33-0x00000000029E0000-0x00000000029E1000-memory.dmp

Filesize
4KB

Download
memory/2944-34-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2944-35-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2944-36-0x00000000029A0000-0x00000000029A1000-memory.dmp

Filesize
4KB

Download
memory/2944-0-0x0000000000400000-0x0000000000685000-memory.dmp

Filesize
2.5MB

Download
memory/2944-38-0x0000000002980000-0x0000000002981000-memory.dmp

Filesize
4KB

Download
memory/2944-30-0x00000000029F0000-0x0000000002AF0000-memory.dmp

Filesize
1024KB

Download
memory/2944-28-0x00000000029F0000-0x0000000002AF0000-memory.dmp

Filesize
1024KB

Download
memory/2944-12-0x00000000007D0000-0x00000000007D1000-memory.dmp

Filesize
4KB

Download
memory/2944-10-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2944-11-0x0000000002960000-0x0000000002962000-memory.dmp

Filesize
8KB

Download
memory/2944-9-0x0000000002970000-0x0000000002971000-memory.dmp

Filesize
4KB

Download
memory/2944-8-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2944-7-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2944-6-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2944-5-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/2944-4-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/2944-3-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2944-2-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/2944-1-0x00000000002B0000-0x00000000002FB000-memory.dmp

Filesize
300KB

Download