Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01-05-2024 12:53
Behavioral task
behavioral1
Sample
HFlashPlayer-windows-0.1.1.zip
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
HFlashPlayer-windows-0.1.1.zip
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
HFlashPlayer.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
HFlashPlayer.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
flashplayer.exe
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
flashplayer.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral7
Sample
unregister.reg
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
unregister.reg
Resource
win10v2004-20240419-en
General
-
Target
HFlashPlayer.exe
-
Size
33KB
-
MD5
6c52eb6343505125e91b788d603c7a39
-
SHA1
7112987259eb367d016e911a2d0afc94c31a0fcf
-
SHA256
05d59d0257868942f418f826695cfb3907ea0bc27df9885657526c376b8ec03f
-
SHA512
227b1ace54100864cb0bdcf58fe7e9edcf45c1d45048729383ec3e887f729c80422da289ea05a8eaaa048e2c542088012609aaed53dd5d345a4f11432a5e0cb8
-
SSDEEP
768:TPprSjI6nXqIpQ9ka3JK6nXqIpQ9kalJy:TxX0XqIi3E0XqIilM
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
HFlashPlayer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hflash\URL Protocol HFlashPlayer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hflash\ = "URL:hflash Protocol" HFlashPlayer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hflash\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\HFlashPlayer.exe %1" HFlashPlayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hflash HFlashPlayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hflash\DefaultIcon HFlashPlayer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hflash\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\HFlashPlayer.exe,1" HFlashPlayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hflash\shell HFlashPlayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hflash\shell\open HFlashPlayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hflash\shell\open\command HFlashPlayer.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
HFlashPlayer.exedescription pid process target process PID 2920 wrote to memory of 2540 2920 HFlashPlayer.exe HFlashPlayer.exe PID 2920 wrote to memory of 2540 2920 HFlashPlayer.exe HFlashPlayer.exe PID 2920 wrote to memory of 2540 2920 HFlashPlayer.exe HFlashPlayer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\HFlashPlayer.exe"C:\Users\Admin\AppData\Local\Temp\HFlashPlayer.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\HFlashPlayer.exe"C:\Users\Admin\AppData\Local\Temp\HFlashPlayer.exe" --register2⤵
- Modifies registry class
PID:2540
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2540-3-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmpFilesize
9.9MB
-
memory/2540-5-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmpFilesize
9.9MB
-
memory/2920-0-0x00000000011D0000-0x00000000011DE000-memory.dmpFilesize
56KB
-
memory/2920-1-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmpFilesize
9.9MB
-
memory/2920-2-0x0000000000C20000-0x0000000000CA0000-memory.dmpFilesize
512KB
-
memory/2920-4-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmpFilesize
9.9MB