Overview
overview
6Static
static
3win-airplay.zip
windows11-21h2-x64
1win-airpla...be.exe
windows11-21h2-x64
3win-airpla...ay.exe
windows11-21h2-x64
3win-airpla...ur.msi
windows11-21h2-x64
6win-airpla...64.msi
windows11-21h2-x64
6win-airplay/SDL2.dll
windows11-21h2-x64
3win-airpla...ay.exe
windows11-21h2-x64
3win-airpla...58.dll
windows11-21h2-x64
3win-airpla...58.dll
windows11-21h2-x64
3win-airpla...56.dll
windows11-21h2-x64
4win-airplay/cairo.dll
windows11-21h2-x64
3win-airpla...ig.dll
windows11-21h2-x64
3win-airpla...pe.dll
windows11-21h2-x64
3win-airpla...nv.dll
windows11-21h2-x64
3win-airpla...st.dll
windows11-21h2-x64
3win-airpla...l2.dll
windows11-21h2-x64
3win-airpla...55.dll
windows11-21h2-x64
3win-airpla...ld.ttf
windows11-21h2-x64
3win-airpla...ht.ttf
windows11-21h2-x64
3win-airpla...ar.ttf
windows11-21h2-x64
3win-airpla...ld.ttf
windows11-21h2-x64
3win-airpla...ht.ttf
windows11-21h2-x64
3win-airpla...ld.ttf
windows11-21h2-x64
3win-airpla...ht.ttf
windows11-21h2-x64
3win-airpla...um.ttf
windows11-21h2-x64
3win-airpla...ar.ttf
windows11-21h2-x64
3win-airpla...ic.ttf
windows11-21h2-x64
3win-airpla...-3.dll
windows11-21h2-x64
3win-airpla...-5.dll
windows11-21h2-x64
3win-airpla...��.url
windows11-21h2-x64
1Resubmissions
03-08-2024 19:46
240803-yg8nestbqr 1003-08-2024 19:44
240803-ygbcxsxhld 603-08-2024 19:41
240803-yd6pnaxgpa 6Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
03-08-2024 19:41
Static task
static1
Behavioral task
behavioral1
Sample
win-airplay.zip
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
win-airplay/Blueberry-Airplay-Youtube.exe
Resource
win11-20240802-en
Behavioral task
behavioral3
Sample
win-airplay/Blueberry-Airplay.exe
Resource
win11-20240802-en
Behavioral task
behavioral4
Sample
win-airplay/Bonjour.msi
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
win-airplay/Bonjour64.msi
Resource
win11-20240802-en
Behavioral task
behavioral6
Sample
win-airplay/SDL2.dll
Resource
win11-20240802-en
Behavioral task
behavioral7
Sample
win-airplay/airplay.exe
Resource
win11-20240802-en
Behavioral task
behavioral8
Sample
win-airplay/avcodec-58.dll
Resource
win11-20240802-en
Behavioral task
behavioral9
Sample
win-airplay/avformat-58.dll
Resource
win11-20240802-en
Behavioral task
behavioral10
Sample
win-airplay/avutil-56.dll
Resource
win11-20240802-en
Behavioral task
behavioral11
Sample
win-airplay/cairo.dll
Resource
win11-20240802-en
Behavioral task
behavioral12
Sample
win-airplay/fontconfig.dll
Resource
win11-20240802-en
Behavioral task
behavioral13
Sample
win-airplay/freetype.dll
Resource
win11-20240802-en
Behavioral task
behavioral14
Sample
win-airplay/libiconv.dll
Resource
win11-20240802-en
Behavioral task
behavioral15
Sample
win-airplay/libplist.dll
Resource
win11-20240802-en
Behavioral task
behavioral16
Sample
win-airplay/libxml2.dll
Resource
win11-20240802-en
Behavioral task
behavioral17
Sample
win-airplay/postproc-55.dll
Resource
win11-20240802-en
Behavioral task
behavioral18
Sample
win-airplay/resources/OpenSans-Bold.ttf
Resource
win11-20240802-en
Behavioral task
behavioral19
Sample
win-airplay/resources/OpenSans-Light.ttf
Resource
win11-20240802-en
Behavioral task
behavioral20
Sample
win-airplay/resources/OpenSans-Regular.ttf
Resource
win11-20240802-en
Behavioral task
behavioral21
Sample
win-airplay/resources/OpenSans-SemiBold.ttf
Resource
win11-20240802-en
Behavioral task
behavioral22
Sample
win-airplay/resources/OpenSansCondensed-Light.ttf
Resource
win11-20240802-en
Behavioral task
behavioral23
Sample
win-airplay/resources/Roboto-Bold.ttf
Resource
win11-20240802-en
Behavioral task
behavioral24
Sample
win-airplay/resources/Roboto-Light.ttf
Resource
win11-20240802-en
Behavioral task
behavioral25
Sample
win-airplay/resources/Roboto-Medium.ttf
Resource
win11-20240802-en
Behavioral task
behavioral26
Sample
win-airplay/resources/Roboto-Regular.ttf
Resource
win11-20240802-en
Behavioral task
behavioral27
Sample
win-airplay/resources/elements_basic.ttf
Resource
win11-20240802-en
Behavioral task
behavioral28
Sample
win-airplay/swresample-3.dll
Resource
win11-20240802-en
Behavioral task
behavioral29
Sample
win-airplay/swscale-5.dll
Resource
win11-20240802-en
Behavioral task
behavioral30
Sample
win-airplay/蓝莓投屏 官网.url
Resource
win11-20240802-en
General
-
Target
win-airplay/resources/OpenSans-Light.ttf
-
Size
217KB
-
MD5
1bf71be111189e76987a4bb9b3115cb7
-
SHA1
40442c189568184b6e6c27a25d69f14d91b65039
-
SHA256
cf5f5184c1441a1660aa52526328e9d5c2793e77b6d8d3a3ad654bdb07ab8424
-
SHA512
cb18b69e98a194af5e3e3d982a75254f3a20bd94c68816a15f38870b9be616cef0c32033f253219cca9146b2b419dd6df28cc4ceeff80d01f400aa0ed101e061
-
SSDEEP
6144:b4kgACfHoUGMxLutgCNktQFvmnoxXTS4uUJt:z2fHowSqCNktA+SXfvJt
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
cmd.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings cmd.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
cmd.exedescription pid process target process PID 2068 wrote to memory of 4940 2068 cmd.exe fontview.exe PID 2068 wrote to memory of 4940 2068 cmd.exe fontview.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\win-airplay\resources\OpenSans-Light.ttf1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\fontview.exe"C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\win-airplay\resources\OpenSans-Light.ttf2⤵