Analysis

  • max time kernel
    152s
  • max time network
    35s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    18-03-2023 00:24

General

  • Target

    Undertale/mus_vsasgore.ogg

  • Size

    1.7MB

  • MD5

    f210e62ee36e85ad97c15efcc0401e9c

  • SHA1

    65c728a3fc987e45e55a1a6b337376a814dff2b1

  • SHA256

    9cf830d2b8b941e82b0822010461b17d9581dd3b98adc7abab8ae5cb5bfb105b

  • SHA512

    50d46f23c743b1200ec7871107bc41d334b7091a3a75001a24b55064d13632564271690dfec4fea83304e9aabe7dff5729af460ef35741d293357a3f2fb1fb46

  • SSDEEP

    24576:lSOZGfabqjuSnopI6DHWwhS8RB4hFb1AFwH4i29rPjRoxL+ec90BicG:XQfabqjumo2AWuRBWV49Jol+VgG

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Undertale\mus_vsasgore.ogg"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:1096
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x48c
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1096-59-0x000000013F2A0000-0x000000013F398000-memory.dmp

    Filesize

    992KB

  • memory/1096-60-0x000007FEFB5E0000-0x000007FEFB614000-memory.dmp

    Filesize

    208KB

  • memory/1096-64-0x000007FEFB5A0000-0x000007FEFB5B1000-memory.dmp

    Filesize

    68KB

  • memory/1096-63-0x000007FEFB5C0000-0x000007FEFB5D7000-memory.dmp

    Filesize

    92KB

  • memory/1096-62-0x000007FEFB8D0000-0x000007FEFB8E8000-memory.dmp

    Filesize

    96KB

  • memory/1096-61-0x000007FEF69D0000-0x000007FEF6C84000-memory.dmp

    Filesize

    2.7MB

  • memory/1096-65-0x000007FEFB580000-0x000007FEFB597000-memory.dmp

    Filesize

    92KB

  • memory/1096-68-0x000007FEFB350000-0x000007FEFB361000-memory.dmp

    Filesize

    68KB

  • memory/1096-67-0x000007FEFB540000-0x000007FEFB55D000-memory.dmp

    Filesize

    116KB

  • memory/1096-66-0x000007FEFB560000-0x000007FEFB571000-memory.dmp

    Filesize

    68KB

  • memory/1096-69-0x000007FEF66E0000-0x000007FEF68E0000-memory.dmp

    Filesize

    2.0MB

  • memory/1096-70-0x000007FEFB310000-0x000007FEFB34F000-memory.dmp

    Filesize

    252KB

  • memory/1096-71-0x000007FEF5630000-0x000007FEF66DB000-memory.dmp

    Filesize

    16.7MB

  • memory/1096-84-0x000007FEF6970000-0x000007FEF69CC000-memory.dmp

    Filesize

    368KB

  • memory/1096-83-0x000007FEF6DE0000-0x000007FEF6DF1000-memory.dmp

    Filesize

    68KB

  • memory/1096-82-0x000007FEF6E00000-0x000007FEF6E6F000-memory.dmp

    Filesize

    444KB

  • memory/1096-81-0x000007FEF6E70000-0x000007FEF6ED7000-memory.dmp

    Filesize

    412KB

  • memory/1096-91-0x000007FEF5390000-0x000007FEF5455000-memory.dmp

    Filesize

    788KB

  • memory/1096-92-0x000007FEF5370000-0x000007FEF5385000-memory.dmp

    Filesize

    84KB

  • memory/1096-94-0x000007FEF5010000-0x000007FEF5022000-memory.dmp

    Filesize

    72KB

  • memory/1096-93-0x000007FEF5030000-0x000007FEF5041000-memory.dmp

    Filesize

    68KB

  • memory/1096-90-0x000007FEF5460000-0x000007FEF5476000-memory.dmp

    Filesize

    88KB

  • memory/1096-89-0x000007FEF6950000-0x000007FEF6961000-memory.dmp

    Filesize

    68KB

  • memory/1096-88-0x000007FEF5480000-0x000007FEF54AF000-memory.dmp

    Filesize

    188KB

  • memory/1096-87-0x000007FEFB530000-0x000007FEFB540000-memory.dmp

    Filesize

    64KB

  • memory/1096-95-0x000007FEF4E90000-0x000007FEF500A000-memory.dmp

    Filesize

    1.5MB

  • memory/1096-86-0x000007FEF6DC0000-0x000007FEF6DD7000-memory.dmp

    Filesize

    92KB

  • memory/1096-85-0x000007FEF54B0000-0x000007FEF5628000-memory.dmp

    Filesize

    1.5MB

  • memory/1096-80-0x000007FEF6EE0000-0x000007FEF6F10000-memory.dmp

    Filesize

    192KB

  • memory/1096-79-0x000007FEF6F10000-0x000007FEF6F28000-memory.dmp

    Filesize

    96KB

  • memory/1096-78-0x000007FEF6F30000-0x000007FEF6F41000-memory.dmp

    Filesize

    68KB

  • memory/1096-77-0x000007FEF6F50000-0x000007FEF6F6B000-memory.dmp

    Filesize

    108KB

  • memory/1096-76-0x000007FEFB260000-0x000007FEFB271000-memory.dmp

    Filesize

    68KB

  • memory/1096-75-0x000007FEFB280000-0x000007FEFB291000-memory.dmp

    Filesize

    68KB

  • memory/1096-74-0x000007FEFB2A0000-0x000007FEFB2B1000-memory.dmp

    Filesize

    68KB

  • memory/1096-73-0x000007FEFB2C0000-0x000007FEFB2D8000-memory.dmp

    Filesize

    96KB

  • memory/1096-72-0x000007FEFB2E0000-0x000007FEFB301000-memory.dmp

    Filesize

    132KB