f6e85a09d34fee8569e913af2a11addf2a6a640e22f2a92e691576bbc89de411

Analysis

max time kernel
143s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
18/03/2023, 00:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Undertale/mus_waterfall.ogg
Size

1.4MB
MD5

76da9c33fa66ec7fe8a1d13d1a43362a
SHA1

3a663ae11ca1a9b26495768f6bb2b6abda2c1fd4
SHA256

3739def3b6bad87ec2215407627ad0464568a46015945bbf6fe23a77dd78827f
SHA512

6c605af5c1f4e7d513340bc75806ddbfaee78e4f5aefa6d4c3b9640588e103d633857cbc3b4f19ecffbe25d872e67a310b19d4db36e8ce50da5ee14f6bf13db8
SSDEEP

24576:8XCxSrLb3GbRtfHksrYeuj7jprl1lh4gH2p+XZbxWSA2y+d8wrQhPi/Lzc:88mLzWTxrYfj7B3Bs+XZXBOwkJ

Score

1^/10

Malware Config

Signatures

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1988	vlc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1988	vlc.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: 33	572	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	572	AUDIODG.EXE
Token: 33	572	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	572	AUDIODG.EXE
Token: 33	1988	vlc.exe
Token: SeIncBasePriorityPrivilege	1988	vlc.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
1988	vlc.exe
1988	vlc.exe
1988	vlc.exe
1988	vlc.exe
1988	vlc.exe
1988	vlc.exe
1988	vlc.exe
1988	vlc.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
1988	vlc.exe
1988	vlc.exe
1988	vlc.exe
1988	vlc.exe
1988	vlc.exe
1988	vlc.exe
1988	vlc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1988	vlc.exe

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Undertale\mus_waterfall.ogg"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1988

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x564
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1988-60-0x000007FEFB480000-0x000007FEFB4B4000-memory.dmp

Filesize
208KB

Download
memory/1988-59-0x000000013F3A0000-0x000000013F498000-memory.dmp

Filesize
992KB

Download
memory/1988-67-0x000007FEFB1B0000-0x000007FEFB1CD000-memory.dmp

Filesize
116KB

Download
memory/1988-66-0x000007FEFB1D0000-0x000007FEFB1E1000-memory.dmp

Filesize
68KB

Download
memory/1988-68-0x000007FEF6A40000-0x000007FEF6C40000-memory.dmp

Filesize
2.0MB

Download
memory/1988-69-0x000007FEFB190000-0x000007FEFB1A1000-memory.dmp

Filesize
68KB

Download
memory/1988-70-0x000007FEFAFE0000-0x000007FEFB01F000-memory.dmp

Filesize
252KB

Download
memory/1988-71-0x000007FEFAFB0000-0x000007FEFAFD1000-memory.dmp

Filesize
132KB

Download
memory/1988-65-0x000007FEFB1F0000-0x000007FEFB207000-memory.dmp

Filesize
92KB

Download
memory/1988-64-0x000007FEFB300000-0x000007FEFB311000-memory.dmp

Filesize
68KB

Download
memory/1988-63-0x000007FEFB320000-0x000007FEFB337000-memory.dmp

Filesize
92KB

Download
memory/1988-62-0x000007FEFBF30000-0x000007FEFBF48000-memory.dmp

Filesize
96KB

Download
memory/1988-61-0x000007FEF6CE0000-0x000007FEF6F94000-memory.dmp

Filesize
2.7MB

Download
memory/1988-72-0x000007FEF5990000-0x000007FEF6A3B000-memory.dmp

Filesize
16.7MB

Download
memory/1988-83-0x000007FEF6CA0000-0x000007FEF6CB1000-memory.dmp

Filesize
68KB

Download
memory/1988-84-0x000007FEF5820000-0x000007FEF587C000-memory.dmp

Filesize
368KB

Download
memory/1988-82-0x000007FEF5880000-0x000007FEF58EF000-memory.dmp

Filesize
444KB

Download
memory/1988-85-0x000007FEF56A0000-0x000007FEF5818000-memory.dmp

Filesize
1.5MB

Download
memory/1988-87-0x000007FEFAF80000-0x000007FEFAF90000-memory.dmp

Filesize
64KB

Download
memory/1988-88-0x000007FEF5650000-0x000007FEF567F000-memory.dmp

Filesize
188KB

Download
memory/1988-89-0x000007FEF5630000-0x000007FEF5641000-memory.dmp

Filesize
68KB

Download
memory/1988-90-0x000007FEF5610000-0x000007FEF5626000-memory.dmp

Filesize
88KB

Download
memory/1988-91-0x000007FEF5540000-0x000007FEF5605000-memory.dmp

Filesize
788KB

Download
memory/1988-92-0x000007FEF5520000-0x000007FEF5535000-memory.dmp

Filesize
84KB

Download
memory/1988-93-0x000007FEF51E0000-0x000007FEF51F1000-memory.dmp

Filesize
68KB

Download
memory/1988-94-0x000007FEF51C0000-0x000007FEF51D2000-memory.dmp

Filesize
72KB

Download
memory/1988-86-0x000007FEF5680000-0x000007FEF5697000-memory.dmp

Filesize
92KB

Download
memory/1988-81-0x000007FEF58F0000-0x000007FEF5957000-memory.dmp

Filesize
412KB

Download
memory/1988-95-0x000007FEF5040000-0x000007FEF51BA000-memory.dmp

Filesize
1.5MB

Download
memory/1988-80-0x000007FEF5960000-0x000007FEF5990000-memory.dmp

Filesize
192KB

Download
memory/1988-79-0x000007FEF6CC0000-0x000007FEF6CD8000-memory.dmp

Filesize
96KB

Download
memory/1988-78-0x000007FEF70D0000-0x000007FEF70E1000-memory.dmp

Filesize
68KB

Download
memory/1988-77-0x000007FEF70F0000-0x000007FEF710B000-memory.dmp

Filesize
108KB

Download
memory/1988-76-0x000007FEF7110000-0x000007FEF7121000-memory.dmp

Filesize
68KB

Download
memory/1988-75-0x000007FEF7130000-0x000007FEF7141000-memory.dmp

Filesize
68KB

Download
memory/1988-74-0x000007FEF7C50000-0x000007FEF7C61000-memory.dmp

Filesize
68KB

Download
memory/1988-73-0x000007FEFAF90000-0x000007FEFAFA8000-memory.dmp

Filesize
96KB

Download