Overview

overview

10

Static

static

3

win-airplay.zip

windows7-x64

10

win-airplay.zip

windows10-2004-x64

1

win-airpla...be.exe

windows7-x64

3

win-airpla...be.exe

windows10-2004-x64

3

win-airpla...ay.exe

windows7-x64

3

win-airpla...ay.exe

windows10-2004-x64

3

win-airpla...ur.msi

windows7-x64

6

win-airpla...ur.msi

windows10-2004-x64

6

win-airpla...64.msi

windows7-x64

6

win-airpla...64.msi

windows10-2004-x64

6

win-airplay/SDL2.dll

windows7-x64

3

win-airplay/SDL2.dll

windows10-2004-x64

3

win-airpla...ay.exe

windows7-x64

3

win-airpla...ay.exe

windows10-2004-x64

3

win-airpla...58.dll

windows7-x64

3

win-airpla...58.dll

windows10-2004-x64

3

win-airpla...58.dll

windows7-x64

3

win-airpla...58.dll

windows10-2004-x64

3

win-airpla...56.dll

windows7-x64

3

win-airpla...56.dll

windows10-2004-x64

3

win-airplay/cairo.dll

windows7-x64

3

win-airplay/cairo.dll

windows10-2004-x64

3

win-airpla...ig.dll

windows7-x64

3

win-airpla...ig.dll

windows10-2004-x64

3

win-airpla...pe.dll

windows7-x64

3

win-airpla...pe.dll

windows10-2004-x64

3

win-airpla...nv.dll

windows7-x64

3

win-airpla...nv.dll

windows10-2004-x64

3

win-airpla...st.dll

windows7-x64

3

win-airpla...st.dll

windows10-2004-x64

3

win-airpla...l2.dll

windows7-x64

3

win-airpla...l2.dll

windows10-2004-x64

3

Resubmissions

03-08-2024 19:46

240803-yg8nestbqr 10

03-08-2024 19:44

240803-ygbcxsxhld 6

03-08-2024 19:41

240803-yd6pnaxgpa 6

Analysis

  • max time kernel
    586s
  • max time network
    370s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    03-08-2024 19:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    win-airplay/airplay.exe

  • Size

    1.2MB

  • MD5

    3658b11fa1c41f50c08aa741f3c28948

  • SHA1

    9340b1c7fc756dfc927287503c0e6e604928a72a

  • SHA256

    89a37cb16c03eda82e5f6309c42358f4f8cea0e279386912a90739ee2b91bca4

  • SHA512

    849274c2d7cbce54d3b57cb54c3f1a754f5017d1658901691a2f8bf2c3e3886d98e125f5134a2627a24e27e83ced8b180d1983f50aa66c279f5b8907363ef5c8

  • SSDEEP

    24576:OUNm5R10DmudnZMu3T9e9SUhZADlBLLfKzCuGCytIAqNnZKuOCzmIMbz7M8Oak4+:u0DXdnZD8DhUiCuGJtIZZKKzmLzptbIV

Score
3/10
discovery

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of FindShellTrayWindow 58 IoCs
  • Suspicious use of SendNotifyMessage 58 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\win-airplay\airplay.exe
    "C:\Users\Admin\AppData\Local\Temp\win-airplay\airplay.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2520

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2520-1-0x0000000000620000-0x000000000062A000-memory.dmp
    Filesize

    40KB

    Download
  • memory/2520-0-0x0000000000620000-0x000000000062A000-memory.dmp
    Filesize

    40KB

    Download
  • memory/2520-2-0x0000000000620000-0x000000000062A000-memory.dmp
    Filesize

    40KB

    Download
  • memory/2520-4-0x0000000000620000-0x000000000062A000-memory.dmp
    Filesize

    40KB

    Download
  • memory/2520-3-0x0000000000620000-0x000000000062A000-memory.dmp
    Filesize

    40KB

    Download
  • memory/2520-5-0x0000000000620000-0x000000000062A000-memory.dmp
    Filesize

    40KB

    Download
  • memory/2520-6-0x0000000000620000-0x000000000062A000-memory.dmp
    Filesize

    40KB

    Download
  • memory/2520-8-0x0000000063F00000-0x0000000063F18000-memory.dmp
    Filesize

    96KB

    Download
  • memory/2520-7-0x0000000073DB0000-0x0000000073ED4000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2520-9-0x0000000073DB0000-0x0000000073ED4000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2520-11-0x0000000073DB0000-0x0000000073ED4000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2520-13-0x0000000073DB0000-0x0000000073ED4000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2520-15-0x0000000073DB0000-0x0000000073ED4000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2520-17-0x0000000073DB0000-0x0000000073ED4000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2520-19-0x0000000073DB0000-0x0000000073ED4000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2520-21-0x0000000073DB0000-0x0000000073ED4000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2520-23-0x0000000073DB0000-0x0000000073ED4000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2520-27-0x0000000073DB0000-0x0000000073ED4000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2520-29-0x0000000073DB0000-0x0000000073ED4000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2520-31-0x0000000073DB0000-0x0000000073ED4000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2520-33-0x0000000073DB0000-0x0000000073ED4000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2520-35-0x0000000073DB0000-0x0000000073ED4000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2520-37-0x0000000073DB0000-0x0000000073ED4000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2520-39-0x0000000073DB0000-0x0000000073ED4000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2520-41-0x0000000073DB0000-0x0000000073ED4000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2520-43-0x0000000073DB0000-0x0000000073ED4000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2520-45-0x0000000073DB0000-0x0000000073ED4000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2520-47-0x0000000073DB0000-0x0000000073ED4000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2520-51-0x0000000073DB0000-0x0000000073ED4000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2520-53-0x0000000073DB0000-0x0000000073ED4000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2520-55-0x0000000073DB0000-0x0000000073ED4000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2520-57-0x0000000073DB0000-0x0000000073ED4000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2520-59-0x0000000073DB0000-0x0000000073ED4000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2520-61-0x0000000073DB0000-0x0000000073ED4000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2520-63-0x0000000073DB0000-0x0000000073ED4000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2520-65-0x0000000073DB0000-0x0000000073ED4000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2520-67-0x0000000073DB0000-0x0000000073ED4000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2520-69-0x0000000073DB0000-0x0000000073ED4000-memory.dmp
    Filesize

    1.1MB

    Download