Analysis

  • max time kernel
    147s
  • max time network
    35s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    18-03-2023 00:24

General

  • Target

    Undertale/mus_z_ending.ogg

  • Size

    2.0MB

  • MD5

    509a522e503ac9d20558c0a9f49fafc3

  • SHA1

    dcb08297bcfec79e2e2bec82a4cc1040c405a4d5

  • SHA256

    499fde981d47e7e5db30e262bb1654c38afa0651a5abb9b8282994fd4ffeebeb

  • SHA512

    3a7e57b95118d5035d4119324733a49620019813320d3eb84615f47220e0fd5d4c67bf92c602701e352974220bd9ade67137f38a1c5eacc493db5d5d59cc88af

  • SSDEEP

    49152:tGdNRzHfxvFuLO9Kv3PBjoeVZLRkpGAEAw:kdTZvcLYK6a8T4

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Undertale\mus_z_ending.ogg"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:1532
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x568
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1532-60-0x000007FEFB8C0000-0x000007FEFB8F4000-memory.dmp

    Filesize

    208KB

  • memory/1532-59-0x000000013F1A0000-0x000000013F298000-memory.dmp

    Filesize

    992KB

  • memory/1532-61-0x000007FEF6ED0000-0x000007FEF7184000-memory.dmp

    Filesize

    2.7MB

  • memory/1532-62-0x000007FEFC140000-0x000007FEFC158000-memory.dmp

    Filesize

    96KB

  • memory/1532-63-0x000007FEFB8A0000-0x000007FEFB8B7000-memory.dmp

    Filesize

    92KB

  • memory/1532-64-0x000007FEFB7B0000-0x000007FEFB7C1000-memory.dmp

    Filesize

    68KB

  • memory/1532-65-0x000007FEFB790000-0x000007FEFB7A7000-memory.dmp

    Filesize

    92KB

  • memory/1532-66-0x000007FEFB5E0000-0x000007FEFB5F1000-memory.dmp

    Filesize

    68KB

  • memory/1532-67-0x000007FEFB5C0000-0x000007FEFB5DD000-memory.dmp

    Filesize

    116KB

  • memory/1532-68-0x000007FEFB530000-0x000007FEFB541000-memory.dmp

    Filesize

    68KB

  • memory/1532-69-0x000007FEF6C50000-0x000007FEF6E50000-memory.dmp

    Filesize

    2.0MB

  • memory/1532-70-0x000007FEF5BA0000-0x000007FEF6C4B000-memory.dmp

    Filesize

    16.7MB

  • memory/1532-75-0x000007FEFB280000-0x000007FEFB291000-memory.dmp

    Filesize

    68KB

  • memory/1532-76-0x000007FEFB260000-0x000007FEFB271000-memory.dmp

    Filesize

    68KB

  • memory/1532-74-0x000007FEFB2A0000-0x000007FEFB2B1000-memory.dmp

    Filesize

    68KB

  • memory/1532-78-0x000007FEFB220000-0x000007FEFB231000-memory.dmp

    Filesize

    68KB

  • memory/1532-79-0x000007FEFB200000-0x000007FEFB218000-memory.dmp

    Filesize

    96KB

  • memory/1532-80-0x000007FEF7310000-0x000007FEF7340000-memory.dmp

    Filesize

    192KB

  • memory/1532-81-0x000007FEF5B30000-0x000007FEF5B97000-memory.dmp

    Filesize

    412KB

  • memory/1532-77-0x000007FEFB240000-0x000007FEFB25B000-memory.dmp

    Filesize

    108KB

  • memory/1532-73-0x000007FEFB4A0000-0x000007FEFB4B8000-memory.dmp

    Filesize

    96KB

  • memory/1532-72-0x000007FEFB4C0000-0x000007FEFB4E1000-memory.dmp

    Filesize

    132KB

  • memory/1532-71-0x000007FEFB4F0000-0x000007FEFB52F000-memory.dmp

    Filesize

    252KB

  • memory/1532-82-0x000007FEF5AC0000-0x000007FEF5B2F000-memory.dmp

    Filesize

    444KB

  • memory/1532-83-0x000007FEF72F0000-0x000007FEF7301000-memory.dmp

    Filesize

    68KB

  • memory/1532-84-0x000007FEF5A60000-0x000007FEF5ABC000-memory.dmp

    Filesize

    368KB

  • memory/1532-85-0x000007FEF58E0000-0x000007FEF5A58000-memory.dmp

    Filesize

    1.5MB

  • memory/1532-86-0x000007FEF72D0000-0x000007FEF72E7000-memory.dmp

    Filesize

    92KB

  • memory/1532-87-0x000007FEFB890000-0x000007FEFB8A0000-memory.dmp

    Filesize

    64KB

  • memory/1532-88-0x000007FEF6EA0000-0x000007FEF6ECF000-memory.dmp

    Filesize

    188KB

  • memory/1532-89-0x000007FEF72B0000-0x000007FEF72C1000-memory.dmp

    Filesize

    68KB

  • memory/1532-90-0x000007FEF58C0000-0x000007FEF58D6000-memory.dmp

    Filesize

    88KB

  • memory/1532-91-0x000007FEF57F0000-0x000007FEF58B5000-memory.dmp

    Filesize

    788KB

  • memory/1532-92-0x000007FEF57D0000-0x000007FEF57E5000-memory.dmp

    Filesize

    84KB

  • memory/1532-93-0x000007FEF5490000-0x000007FEF54A1000-memory.dmp

    Filesize

    68KB

  • memory/1532-94-0x000007FEF5470000-0x000007FEF5482000-memory.dmp

    Filesize

    72KB

  • memory/1532-95-0x000007FEF52F0000-0x000007FEF546A000-memory.dmp

    Filesize

    1.5MB

  • memory/1532-98-0x000007FEF6ED0000-0x000007FEF7184000-memory.dmp

    Filesize

    2.7MB

  • memory/1532-107-0x000007FEF5BA0000-0x000007FEF6C4B000-memory.dmp

    Filesize

    16.7MB