Overview
overview
7Static
static
3TVK.exe
windows7-x64
7TVK.exe
windows10-2004-x64
7//...ll.exe
windows7-x64
//...ll.exe
windows10-2004-x64
/Buffering.htm
windows7-x64
/Buffering.htm
windows10-2004-x64
/LoginTV.htm
windows7-x64
/LoginTV.htm
windows10-2004-x64
/WhatsNew.htm
windows7-x64
/WhatsNew.htm
windows10-2004-x64
/config.dll
windows7-x64
/config.dll
windows10-2004-x64
/mobilefee.htm
windows7-x64
/mobilefee.htm
windows10-2004-x64
/setup.exe
windows7-x64
/setup.exe
windows10-2004-x64
$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$TEMP/modules/$R0.dll
windows7-x64
6$TEMP/modules/$R0.dll
windows10-2004-x64
6$TEMP/modu...dr.dll
windows7-x64
6$TEMP/modu...dr.dll
windows10-2004-x64
6$TEMP/modu...xr.dll
windows7-x64
7$TEMP/modu...xr.dll
windows10-2004-x64
7$TEMP/modu...xr.exe
windows7-x64
1$TEMP/modu...xr.exe
windows10-2004-x64
1$TEMP/modu...ll.exe
windows7-x64
1$TEMP/modu...ll.exe
windows10-2004-x64
1$TEMP/modu...gn.dll
windows7-x64
1$TEMP/modu...gn.dll
windows10-2004-x64
1Analysis
- max time kernel
101s - max time network
19s - platform
windows7_x64 - resource
win7-20240704-en - resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system - submitted
09/07/2024, 13:59
Static task
static1
Behavioral task
behavioral1
Sample
TVK.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral2
Sample
TVK.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
//uninstall.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral4
Sample
//uninstall.exe
Resource
win10v2004-20240708-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
/Buffering.htm
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral6
Sample
/Buffering.htm
Resource
win10v2004-20240704-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
/LoginTV.htm
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral8
Sample
/LoginTV.htm
Resource
win10v2004-20240704-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
/WhatsNew.htm
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral10
Sample
/WhatsNew.htm
Resource
win10v2004-20240708-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
/config.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral12
Sample
/config.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
/mobilefee.htm
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral14
Sample
/mobilefee.htm
Resource
win10v2004-20240704-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
/setup.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral16
Sample
/setup.exe
Resource
win10v2004-20240708-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral18
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral20
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
$TEMP/modules/$R0.dll
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral22
Sample
$TEMP/modules/$R0.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
$TEMP/modules/addr.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral24
Sample
$TEMP/modules/addr.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
$TEMP/modules/auxr.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral26
Sample
$TEMP/modules/auxr.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
$TEMP/modules/auxr.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral28
Sample
$TEMP/modules/auxr.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
$TEMP/modules/shell.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral30
Sample
$TEMP/modules/shell.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
$TEMP/modules/sign.dll
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral32
Sample
$TEMP/modules/sign.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
General
- Target TVK.exe
- Size 1.8MB
- Sample240709-ragg2ayfke
- SHA256 49ff2e5130f5eface959ad9926fd7a6095c6e2b3341b246b772a94362493cc33
- MD5 423c464233957c5051d0ff3c99374eb9
- SHA1 b6f57eddda400ad497944ee9e83a1f5668fdf17c
- SHA512 0e7b9bfbf08f5ccfae2a4e0eb5b781c4942401112734d86ba1363321be8ce45f5fdfad373122b35edb5b27af6b96f54b2084cb18e30162d5be4543a607aafc48
- SSDEEP 49152:EOEnpV1qK/jsTargC/1TuusZWhKWGL6ImfT:bgcK7rBtTuuVZGL6TT
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 2948 TVK.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2948 TVK.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nszF4BD.tmp\ioSpecial.ini
- Size 548B
- SHA256 d5a3aa1fb9f717e3daa9e1fc9f57a64a323439c6b85ebc2c56ef2c3fcf7be227
- MD5 4adc6fc7473ccc7b4579022d3d1f057c
- SHA1 e9e399efc9883bca28665f99526b10fd8470ead6
- SHA512 f59b1971f965c354dee2b0cd422760798bfd2c1eb379c59da817ca308dbcf617731a5d00e19a16aef559aa20d6c866af64e9edbc619e8147b045103a91c5a4d9
- MD5 SHA1 SHA512
- Path \Users\Admin\AppData\Local\Temp\nszF4BD.tmp\InstallOptions.dll
- Size 12KB
- SHA256 4f871b4c8815758f7718ad68d688c6dc05cae205ddf3bcb00147a99746414435
- MD5 695751df50c11f303b060d63eababe1d
- SHA1 ffa5fa91750c3e63589fecae8aa90c232611c94d
- SHA512 c9877e0d08c65b23717f3acf3be92ead79c6afde594bd4358694e128fb7149f4a1f33380fae0fb65411e5c68a9d91d2a353b4ef3da5169d3452441eb65880ce0
- SSDEEP 192:ebtwKT+lyf+vQ/QnXN4dGIIvfe+ncp+hebyWLblA3xrh3Gr4:gtwKTOyZQX+dGNvfe+2+1WLbsxBG
- MD5 SHA1 SHA512 SSDEEP