Analysis

  • max time kernel
    144s
  • max time network
    35s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    18/03/2023, 00:24

General

  • Target

    Undertale/mus_undynetruetheme.ogg

  • Size

    935KB

  • MD5

    a406b15d0e513ab4cfa25177dae99561

  • SHA1

    b806ae43e0d3e1e94eb074217dc0c7d32fa4ab33

  • SHA256

    795cafff0fd78abc5bc55ca5e556f8839d20daddf1a4023e3183f70c3329ff4f

  • SHA512

    6e5039b053aa67b51e48f1ac026a815909f0942def7b22d7a1549a518f70fc40b317075e6a6ba8c096082542d4a0caf738bcd6514c7c59961713c2643c35ecad

  • SSDEEP

    24576:jB1IsB8JDJ7NkfiuNY6iUTwSvzaKY5mUoWO4DKQhN:j0sBqN7Eq0MSWKY5mUoWOgKON

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Undertale\mus_undynetruetheme.ogg"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:1956
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x570
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1348

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1956-60-0x000007FEFB430000-0x000007FEFB464000-memory.dmp

          Filesize

          208KB

        • memory/1956-59-0x000000013FBE0000-0x000000013FCD8000-memory.dmp

          Filesize

          992KB

        • memory/1956-66-0x000007FEFB190000-0x000007FEFB1A1000-memory.dmp

          Filesize

          68KB

        • memory/1956-67-0x000007FEFB170000-0x000007FEFB18D000-memory.dmp

          Filesize

          116KB

        • memory/1956-68-0x000007FEFB150000-0x000007FEFB161000-memory.dmp

          Filesize

          68KB

        • memory/1956-61-0x000007FEF6AD0000-0x000007FEF6D84000-memory.dmp

          Filesize

          2.7MB

        • memory/1956-69-0x000007FEF6870000-0x000007FEF6A70000-memory.dmp

          Filesize

          2.0MB

        • memory/1956-65-0x000007FEFB1B0000-0x000007FEFB1C7000-memory.dmp

          Filesize

          92KB

        • memory/1956-70-0x000007FEFB110000-0x000007FEFB14F000-memory.dmp

          Filesize

          252KB

        • memory/1956-64-0x000007FEFB390000-0x000007FEFB3A1000-memory.dmp

          Filesize

          68KB

        • memory/1956-63-0x000007FEFB3B0000-0x000007FEFB3C7000-memory.dmp

          Filesize

          92KB

        • memory/1956-62-0x000007FEFBE80000-0x000007FEFBE98000-memory.dmp

          Filesize

          96KB

        • memory/1956-71-0x000007FEF5040000-0x000007FEF60EB000-memory.dmp

          Filesize

          16.7MB

        • memory/1956-72-0x000007FEFB0E0000-0x000007FEFB101000-memory.dmp

          Filesize

          132KB

        • memory/1956-76-0x000007FEFAE20000-0x000007FEFAE31000-memory.dmp

          Filesize

          68KB

        • memory/1956-77-0x000007FEFAE00000-0x000007FEFAE1B000-memory.dmp

          Filesize

          108KB

        • memory/1956-81-0x000007FEF6800000-0x000007FEF6867000-memory.dmp

          Filesize

          412KB

        • memory/1956-82-0x000007FEF6790000-0x000007FEF67FF000-memory.dmp

          Filesize

          444KB

        • memory/1956-83-0x000007FEF6EB0000-0x000007FEF6EC1000-memory.dmp

          Filesize

          68KB

        • memory/1956-84-0x000007FEF6730000-0x000007FEF678C000-memory.dmp

          Filesize

          368KB

        • memory/1956-80-0x000007FEF6ED0000-0x000007FEF6F00000-memory.dmp

          Filesize

          192KB

        • memory/1956-79-0x000007FEF6F00000-0x000007FEF6F18000-memory.dmp

          Filesize

          96KB

        • memory/1956-78-0x000007FEF6F20000-0x000007FEF6F31000-memory.dmp

          Filesize

          68KB

        • memory/1956-87-0x000007FEF7A40000-0x000007FEF7A50000-memory.dmp

          Filesize

          64KB

        • memory/1956-88-0x000007FEF6580000-0x000007FEF65AF000-memory.dmp

          Filesize

          188KB

        • memory/1956-89-0x000007FEF6A90000-0x000007FEF6AA1000-memory.dmp

          Filesize

          68KB

        • memory/1956-90-0x000007FEF6560000-0x000007FEF6576000-memory.dmp

          Filesize

          88KB

        • memory/1956-94-0x000007FEF4FA0000-0x000007FEF4FB2000-memory.dmp

          Filesize

          72KB

        • memory/1956-93-0x000007FEF61B0000-0x000007FEF61C1000-memory.dmp

          Filesize

          68KB

        • memory/1956-92-0x000007FEF6470000-0x000007FEF6485000-memory.dmp

          Filesize

          84KB

        • memory/1956-95-0x000007FEF4E20000-0x000007FEF4F9A000-memory.dmp

          Filesize

          1.5MB

        • memory/1956-91-0x000007FEF6490000-0x000007FEF6555000-memory.dmp

          Filesize

          788KB

        • memory/1956-86-0x000007FEF6AB0000-0x000007FEF6AC7000-memory.dmp

          Filesize

          92KB

        • memory/1956-85-0x000007FEF65B0000-0x000007FEF6728000-memory.dmp

          Filesize

          1.5MB

        • memory/1956-75-0x000007FEFAE40000-0x000007FEFAE51000-memory.dmp

          Filesize

          68KB

        • memory/1956-74-0x000007FEFAE60000-0x000007FEFAE71000-memory.dmp

          Filesize

          68KB

        • memory/1956-73-0x000007FEFAE80000-0x000007FEFAE98000-memory.dmp

          Filesize

          96KB

        • memory/1956-108-0x000007FEF5040000-0x000007FEF60EB000-memory.dmp

          Filesize

          16.7MB