Analysis

  • max time kernel
    143s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    18-03-2023 00:24

General

  • Target

    Undertale/mus_xpart_b.ogg

  • Size

    496KB

  • MD5

    cad302511456bd2cca081ea96081001f

  • SHA1

    66a4acc681ba61e42940d4f2e04371b80fd87dea

  • SHA256

    17f58a8895bcb998f176f2cde5f70e1aea041e7ac895d1d29f9e5c21a170b1ff

  • SHA512

    82bbef6d07d4aa485be746c55af14522ba61602f12591c5655fa29c1f424c79c65d9f87fc7865eb0cf8d531671acf09f55702b831ae5cc55a6a2217f7142e520

  • SSDEEP

    12288:RigdaDrXCcfvxhufZeg4sVXA84v78IVqtS2jFOn09Vg+V:RigwwhDK8YnVqnJOmVg+V

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Undertale\mus_xpart_b.ogg"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:1376
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0xc4
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1376-59-0x000000013FFE0000-0x00000001400D8000-memory.dmp

    Filesize

    992KB

  • memory/1376-60-0x000007FEFB7D0000-0x000007FEFB804000-memory.dmp

    Filesize

    208KB

  • memory/1376-61-0x000007FEF6EE0000-0x000007FEF7194000-memory.dmp

    Filesize

    2.7MB

  • memory/1376-63-0x000007FEFB740000-0x000007FEFB757000-memory.dmp

    Filesize

    92KB

  • memory/1376-62-0x000007FEFBC90000-0x000007FEFBCA8000-memory.dmp

    Filesize

    96KB

  • memory/1376-64-0x000007FEFB720000-0x000007FEFB731000-memory.dmp

    Filesize

    68KB

  • memory/1376-65-0x000007FEFB700000-0x000007FEFB717000-memory.dmp

    Filesize

    92KB

  • memory/1376-66-0x000007FEFB490000-0x000007FEFB4A1000-memory.dmp

    Filesize

    68KB

  • memory/1376-68-0x000007FEFB1A0000-0x000007FEFB1B1000-memory.dmp

    Filesize

    68KB

  • memory/1376-67-0x000007FEFB1C0000-0x000007FEFB1DD000-memory.dmp

    Filesize

    116KB

  • memory/1376-69-0x000007FEF5450000-0x000007FEF64FB000-memory.dmp

    Filesize

    16.7MB

  • memory/1376-70-0x000007FEF6CE0000-0x000007FEF6EE0000-memory.dmp

    Filesize

    2.0MB

  • memory/1376-71-0x000007FEFB160000-0x000007FEFB19F000-memory.dmp

    Filesize

    252KB

  • memory/1376-72-0x000007FEFB130000-0x000007FEFB151000-memory.dmp

    Filesize

    132KB

  • memory/1376-73-0x000007FEF7460000-0x000007FEF7478000-memory.dmp

    Filesize

    96KB

  • memory/1376-74-0x000007FEF7440000-0x000007FEF7451000-memory.dmp

    Filesize

    68KB

  • memory/1376-75-0x000007FEF7420000-0x000007FEF7431000-memory.dmp

    Filesize

    68KB

  • memory/1376-76-0x000007FEF7400000-0x000007FEF7411000-memory.dmp

    Filesize

    68KB

  • memory/1376-77-0x000007FEF73E0000-0x000007FEF73FB000-memory.dmp

    Filesize

    108KB

  • memory/1376-78-0x000007FEF73C0000-0x000007FEF73D1000-memory.dmp

    Filesize

    68KB

  • memory/1376-79-0x000007FEF73A0000-0x000007FEF73B8000-memory.dmp

    Filesize

    96KB

  • memory/1376-80-0x000007FEF7370000-0x000007FEF73A0000-memory.dmp

    Filesize

    192KB

  • memory/1376-81-0x000007FEF7300000-0x000007FEF7367000-memory.dmp

    Filesize

    412KB

  • memory/1376-82-0x000007FEF6C70000-0x000007FEF6CDF000-memory.dmp

    Filesize

    444KB

  • memory/1376-83-0x000007FEF72E0000-0x000007FEF72F1000-memory.dmp

    Filesize

    68KB

  • memory/1376-84-0x000007FEF6C10000-0x000007FEF6C6C000-memory.dmp

    Filesize

    368KB

  • memory/1376-85-0x000007FEF6A90000-0x000007FEF6C08000-memory.dmp

    Filesize

    1.5MB

  • memory/1376-86-0x000007FEF72C0000-0x000007FEF72D7000-memory.dmp

    Filesize

    92KB

  • memory/1376-87-0x000007FEFB6F0000-0x000007FEFB700000-memory.dmp

    Filesize

    64KB

  • memory/1376-88-0x000007FEF6A60000-0x000007FEF6A8F000-memory.dmp

    Filesize

    188KB

  • memory/1376-89-0x000007FEF6A40000-0x000007FEF6A51000-memory.dmp

    Filesize

    68KB

  • memory/1376-90-0x000007FEF6A20000-0x000007FEF6A36000-memory.dmp

    Filesize

    88KB

  • memory/1376-91-0x000007FEF6950000-0x000007FEF6A15000-memory.dmp

    Filesize

    788KB

  • memory/1376-92-0x000007FEF6930000-0x000007FEF6945000-memory.dmp

    Filesize

    84KB

  • memory/1376-93-0x000007FEF65F0000-0x000007FEF6601000-memory.dmp

    Filesize

    68KB

  • memory/1376-94-0x000007FEF65D0000-0x000007FEF65E2000-memory.dmp

    Filesize

    72KB

  • memory/1376-95-0x000007FEF52D0000-0x000007FEF544A000-memory.dmp

    Filesize

    1.5MB

  • memory/1376-106-0x000007FEF5450000-0x000007FEF64FB000-memory.dmp

    Filesize

    16.7MB