Analysis

  • max time kernel
    146s
  • max time network
    32s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    18-03-2023 00:24

General

  • Target

    Undertale/mus_waterquiet.ogg

  • Size

    237KB

  • MD5

    e62ba6eba4d5351d526c9b10ccc595dc

  • SHA1

    a2b49fdf1ce15f75809a58e5514584e0a9c6aade

  • SHA256

    38c9bcb1338b4bead4b60489e41d75ccb60f222f804ffc4218d7e12a53cb3c94

  • SHA512

    71525e980dada0a29c041aa7a7c8e682a71b440fbd4d3e2efdf8ba8f6458c9262bb681a6ecc3ae91eac9f5e753f50e40c9b0b9d7d057100ad5a828701c441172

  • SSDEEP

    6144:a+ndlkYEnGpqZdNzL6GoWRH0u5XVL4dI+/8lnzE0gXi0yK:a6B5u3mG1WKV8I+/8tPEig

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Undertale\mus_waterquiet.ogg"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:2020
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x56c
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2020-60-0x000007FEFAEC0000-0x000007FEFAEF4000-memory.dmp

    Filesize

    208KB

  • memory/2020-59-0x000000013F450000-0x000000013F548000-memory.dmp

    Filesize

    992KB

  • memory/2020-68-0x000007FEF6460000-0x000007FEF6660000-memory.dmp

    Filesize

    2.0MB

  • memory/2020-69-0x000007FEFA950000-0x000007FEFA961000-memory.dmp

    Filesize

    68KB

  • memory/2020-70-0x000007FEFA910000-0x000007FEFA94F000-memory.dmp

    Filesize

    252KB

  • memory/2020-71-0x000007FEFA8E0000-0x000007FEFA901000-memory.dmp

    Filesize

    132KB

  • memory/2020-72-0x000007FEF6B50000-0x000007FEF6B68000-memory.dmp

    Filesize

    96KB

  • memory/2020-67-0x000007FEFA970000-0x000007FEFA98D000-memory.dmp

    Filesize

    116KB

  • memory/2020-66-0x000007FEFAB90000-0x000007FEFABA1000-memory.dmp

    Filesize

    68KB

  • memory/2020-65-0x000007FEFAE10000-0x000007FEFAE27000-memory.dmp

    Filesize

    92KB

  • memory/2020-64-0x000007FEFAE30000-0x000007FEFAE41000-memory.dmp

    Filesize

    68KB

  • memory/2020-63-0x000007FEFAEA0000-0x000007FEFAEB7000-memory.dmp

    Filesize

    92KB

  • memory/2020-62-0x000007FEFB850000-0x000007FEFB868000-memory.dmp

    Filesize

    96KB

  • memory/2020-61-0x000007FEF6660000-0x000007FEF6914000-memory.dmp

    Filesize

    2.7MB

  • memory/2020-74-0x000007FEF6B30000-0x000007FEF6B41000-memory.dmp

    Filesize

    68KB

  • memory/2020-75-0x000007FEF6B10000-0x000007FEF6B21000-memory.dmp

    Filesize

    68KB

  • memory/2020-84-0x000007FEF6390000-0x000007FEF63EC000-memory.dmp

    Filesize

    368KB

  • memory/2020-85-0x000007FEF6210000-0x000007FEF6388000-memory.dmp

    Filesize

    1.5MB

  • memory/2020-86-0x000007FEF69B0000-0x000007FEF69C7000-memory.dmp

    Filesize

    92KB

  • memory/2020-87-0x000007FEFAE90000-0x000007FEFAEA0000-memory.dmp

    Filesize

    64KB

  • memory/2020-88-0x000007FEF61E0000-0x000007FEF620F000-memory.dmp

    Filesize

    188KB

  • memory/2020-89-0x000007FEF61C0000-0x000007FEF61D1000-memory.dmp

    Filesize

    68KB

  • memory/2020-90-0x000007FEF61A0000-0x000007FEF61B6000-memory.dmp

    Filesize

    88KB

  • memory/2020-83-0x000007FEF69D0000-0x000007FEF69E1000-memory.dmp

    Filesize

    68KB

  • memory/2020-94-0x000007FEF5D50000-0x000007FEF5D62000-memory.dmp

    Filesize

    72KB

  • memory/2020-93-0x000007FEF5D70000-0x000007FEF5D81000-memory.dmp

    Filesize

    68KB

  • memory/2020-92-0x000007FEF60B0000-0x000007FEF60C5000-memory.dmp

    Filesize

    84KB

  • memory/2020-95-0x000007FEF4A50000-0x000007FEF4BCA000-memory.dmp

    Filesize

    1.5MB

  • memory/2020-91-0x000007FEF60D0000-0x000007FEF6195000-memory.dmp

    Filesize

    788KB

  • memory/2020-82-0x000007FEF63F0000-0x000007FEF645F000-memory.dmp

    Filesize

    444KB

  • memory/2020-81-0x000007FEF69F0000-0x000007FEF6A57000-memory.dmp

    Filesize

    412KB

  • memory/2020-80-0x000007FEF6A60000-0x000007FEF6A90000-memory.dmp

    Filesize

    192KB

  • memory/2020-79-0x000007FEF6A90000-0x000007FEF6AA8000-memory.dmp

    Filesize

    96KB

  • memory/2020-78-0x000007FEF6AB0000-0x000007FEF6AC1000-memory.dmp

    Filesize

    68KB

  • memory/2020-77-0x000007FEF6AD0000-0x000007FEF6AEB000-memory.dmp

    Filesize

    108KB

  • memory/2020-76-0x000007FEF6AF0000-0x000007FEF6B01000-memory.dmp

    Filesize

    68KB

  • memory/2020-73-0x000007FEF4BD0000-0x000007FEF5C7B000-memory.dmp

    Filesize

    16.7MB

  • memory/2020-110-0x000007FEF4BD0000-0x000007FEF5C7B000-memory.dmp

    Filesize

    16.7MB