f6e85a09d34fee8569e913af2a11addf2a6a640e22f2a92e691576bbc89de411

Analysis

max time kernel
149s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
18/03/2023, 00:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Undertale/mus_xpart_back.ogg
Size

194KB
MD5

cf327bbd54e3e211e8e268f548bd3b26
SHA1

3731fe3f8ee640bb11f32849fcbfb04ba6657c13
SHA256

97024dc4c151d2e8558e00facb66d8e0ee180e168f1f4246d4f8164c56b0a878
SHA512

30385a2ae088a6205ea0a171fff4af32e0d739a1fbc71df6e1d2f6f892958e37c66f764747adceb9eb12d4344fd699a385451d410d9111675fe91047c90e5ea6
SSDEEP

3072:BEN0H9+ksNLk0UsYmLmFvYF9D2Z8qO/HljoGZsxdgzf9+qUDjrURke1ZDjLwIkw:BEN+MTLkjsvovWDA8d9jo1ylUReTjsIr

Score

1^/10

Malware Config

Signatures

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1936	vlc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1936	vlc.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: 33	1300	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1300	AUDIODG.EXE
Token: 33	1300	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1300	AUDIODG.EXE
Token: 33	1936	vlc.exe
Token: SeIncBasePriorityPrivilege	1936	vlc.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
1936	vlc.exe
1936	vlc.exe
1936	vlc.exe
1936	vlc.exe
1936	vlc.exe
1936	vlc.exe
1936	vlc.exe
1936	vlc.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
1936	vlc.exe
1936	vlc.exe
1936	vlc.exe
1936	vlc.exe
1936	vlc.exe
1936	vlc.exe
1936	vlc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1936	vlc.exe

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Undertale\mus_xpart_back.ogg"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1936

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x558
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1936-59-0x000000013F360000-0x000000013F458000-memory.dmp

Filesize
992KB

Download
memory/1936-60-0x000007FEF6A40000-0x000007FEF6A74000-memory.dmp

Filesize
208KB

Download
memory/1936-61-0x000007FEF6010000-0x000007FEF62C4000-memory.dmp

Filesize
2.7MB

Download
memory/1936-67-0x000007FEF6420000-0x000007FEF643D000-memory.dmp

Filesize
116KB

Download
memory/1936-72-0x000007FEF5D40000-0x000007FEF5D58000-memory.dmp

Filesize
96KB

Download
memory/1936-71-0x000007FEF5D60000-0x000007FEF5D81000-memory.dmp

Filesize
132KB

Download
memory/1936-70-0x000007FEF5FD0000-0x000007FEF600F000-memory.dmp

Filesize
252KB

Download
memory/1936-69-0x000007FEF6400000-0x000007FEF6411000-memory.dmp

Filesize
68KB

Download
memory/1936-68-0x000007FEF5D90000-0x000007FEF5F90000-memory.dmp

Filesize
2.0MB

Download
memory/1936-66-0x000007FEF6440000-0x000007FEF6451000-memory.dmp

Filesize
68KB

Download
memory/1936-65-0x000007FEF6460000-0x000007FEF6477000-memory.dmp

Filesize
92KB

Download
memory/1936-64-0x000007FEF6A00000-0x000007FEF6A11000-memory.dmp

Filesize
68KB

Download
memory/1936-63-0x000007FEF6A20000-0x000007FEF6A37000-memory.dmp

Filesize
92KB

Download
memory/1936-73-0x000007FEF4C90000-0x000007FEF5D3B000-memory.dmp

Filesize
16.7MB

Download
memory/1936-62-0x000007FEFB390000-0x000007FEFB3A8000-memory.dmp

Filesize
96KB

Download
memory/1936-82-0x000007FEF4AC0000-0x000007FEF4B2F000-memory.dmp

Filesize
444KB

Download
memory/1936-83-0x000007FEF4AA0000-0x000007FEF4AB1000-memory.dmp

Filesize
68KB

Download
memory/1936-81-0x000007FEF4B30000-0x000007FEF4B97000-memory.dmp

Filesize
412KB

Download
memory/1936-80-0x000007FEF4BA0000-0x000007FEF4BD0000-memory.dmp

Filesize
192KB

Download
memory/1936-79-0x000007FEF4BD0000-0x000007FEF4BE8000-memory.dmp

Filesize
96KB

Download
memory/1936-78-0x000007FEF4BF0000-0x000007FEF4C01000-memory.dmp

Filesize
68KB

Download
memory/1936-84-0x000007FEF4A40000-0x000007FEF4A9C000-memory.dmp

Filesize
368KB

Download
memory/1936-90-0x000007FEF4830000-0x000007FEF4846000-memory.dmp

Filesize
88KB

Download
memory/1936-91-0x000007FEF4760000-0x000007FEF4825000-memory.dmp

Filesize
788KB

Download
memory/1936-92-0x000007FEF4740000-0x000007FEF4755000-memory.dmp

Filesize
84KB

Download
memory/1936-93-0x000007FEF4400000-0x000007FEF4411000-memory.dmp

Filesize
68KB

Download
memory/1936-94-0x000007FEF43E0000-0x000007FEF43F2000-memory.dmp

Filesize
72KB

Download
memory/1936-89-0x000007FEF4850000-0x000007FEF4861000-memory.dmp

Filesize
68KB

Download
memory/1936-88-0x000007FEF4870000-0x000007FEF489F000-memory.dmp

Filesize
188KB

Download
memory/1936-87-0x000007FEF6F80000-0x000007FEF6F90000-memory.dmp

Filesize
64KB

Download
memory/1936-86-0x000007FEF48A0000-0x000007FEF48B7000-memory.dmp

Filesize
92KB

Download
memory/1936-85-0x000007FEF48C0000-0x000007FEF4A38000-memory.dmp

Filesize
1.5MB

Download
memory/1936-95-0x000007FEF4260000-0x000007FEF43DA000-memory.dmp

Filesize
1.5MB

Download
memory/1936-77-0x000007FEF4C10000-0x000007FEF4C2B000-memory.dmp

Filesize
108KB

Download
memory/1936-76-0x000007FEF4C30000-0x000007FEF4C41000-memory.dmp

Filesize
68KB

Download
memory/1936-75-0x000007FEF4C50000-0x000007FEF4C61000-memory.dmp

Filesize
68KB

Download
memory/1936-74-0x000007FEF4C70000-0x000007FEF4C81000-memory.dmp

Filesize
68KB

Download
memory/1936-98-0x000007FEF6010000-0x000007FEF62C4000-memory.dmp

Filesize
2.7MB

Download
memory/1936-110-0x000007FEF4C90000-0x000007FEF5D3B000-memory.dmp

Filesize
16.7MB

Download