Analysis

  • max time kernel
    156s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    31-03-2023 18:52

General

  • Target

    hra/LLL_Mantis_Data/StreamingAssets/Apex Legends.wav

  • Size

    442KB

  • MD5

    34897e308ce56a489fcfca6c7ca54adf

  • SHA1

    076d676a489c947bf778e4e5eb71478255d1666b

  • SHA256

    bf49bc18d61625c14cb26fa0ded97e3400deee37823343af99bb4ad6310c930c

  • SHA512

    8092f6ba9993ecfcac69943f42310ba5f7c8239c82f61369a6b880c2c6a2afd6f06144d4906abf65b7eb5382ce71bc75b685975aaad757fefbddbe661f0648ba

  • SSDEEP

    12288:TmWVDbPfY8kuxm1pluYw4JwWIHPAxqNIZ9Q8D5siOe0lspg:TmU7k0OpVJuHYxqNuac5srekWg

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\hra\LLL_Mantis_Data\StreamingAssets\Apex Legends.wav"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:824
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x54c
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/824-54-0x000000013FFB0000-0x00000001400A8000-memory.dmp

    Filesize

    992KB

  • memory/824-60-0x000007FEFB1B0000-0x000007FEFB1E4000-memory.dmp

    Filesize

    208KB

  • memory/824-61-0x000007FEF6940000-0x000007FEF6BF4000-memory.dmp

    Filesize

    2.7MB

  • memory/824-62-0x000007FEFB810000-0x000007FEFB828000-memory.dmp

    Filesize

    96KB

  • memory/824-63-0x000007FEFB160000-0x000007FEFB177000-memory.dmp

    Filesize

    92KB

  • memory/824-64-0x000007FEFB140000-0x000007FEFB151000-memory.dmp

    Filesize

    68KB

  • memory/824-65-0x000007FEFB100000-0x000007FEFB117000-memory.dmp

    Filesize

    92KB

  • memory/824-66-0x000007FEFB0E0000-0x000007FEFB0F1000-memory.dmp

    Filesize

    68KB

  • memory/824-67-0x000007FEFB0C0000-0x000007FEFB0DD000-memory.dmp

    Filesize

    116KB

  • memory/824-68-0x000007FEFAE50000-0x000007FEFAE61000-memory.dmp

    Filesize

    68KB

  • memory/824-69-0x000007FEF6220000-0x000007FEF6420000-memory.dmp

    Filesize

    2.0MB

  • memory/824-70-0x000007FEF5170000-0x000007FEF621B000-memory.dmp

    Filesize

    16.7MB

  • memory/824-76-0x000007FEFAC10000-0x000007FEFAC21000-memory.dmp

    Filesize

    68KB

  • memory/824-77-0x000007FEF78B0000-0x000007FEF78CB000-memory.dmp

    Filesize

    108KB

  • memory/824-78-0x000007FEF7320000-0x000007FEF7331000-memory.dmp

    Filesize

    68KB

  • memory/824-79-0x000007FEF6D00000-0x000007FEF6D18000-memory.dmp

    Filesize

    96KB

  • memory/824-80-0x000007FEF6CD0000-0x000007FEF6D00000-memory.dmp

    Filesize

    192KB

  • memory/824-75-0x000007FEFAC30000-0x000007FEFAC41000-memory.dmp

    Filesize

    68KB

  • memory/824-82-0x000007FEF6790000-0x000007FEF67FF000-memory.dmp

    Filesize

    444KB

  • memory/824-81-0x000007FEF6800000-0x000007FEF6867000-memory.dmp

    Filesize

    412KB

  • memory/824-83-0x000007FEF6CB0000-0x000007FEF6CC1000-memory.dmp

    Filesize

    68KB

  • memory/824-74-0x000007FEFAC50000-0x000007FEFAC61000-memory.dmp

    Filesize

    68KB

  • memory/824-73-0x000007FEFADF0000-0x000007FEFAE08000-memory.dmp

    Filesize

    96KB

  • memory/824-84-0x000007FEF6730000-0x000007FEF6786000-memory.dmp

    Filesize

    344KB

  • memory/824-72-0x000007FEFAC70000-0x000007FEFAC91000-memory.dmp

    Filesize

    132KB

  • memory/824-86-0x000007FEF6700000-0x000007FEF6724000-memory.dmp

    Filesize

    144KB

  • memory/824-85-0x000007FEF6910000-0x000007FEF6938000-memory.dmp

    Filesize

    160KB

  • memory/824-71-0x000007FEFAE10000-0x000007FEFAE4F000-memory.dmp

    Filesize

    252KB

  • memory/824-87-0x000007FEF6C90000-0x000007FEF6CA7000-memory.dmp

    Filesize

    92KB

  • memory/824-88-0x000007FEF6570000-0x000007FEF6593000-memory.dmp

    Filesize

    140KB

  • memory/824-89-0x000007FEF64E0000-0x000007FEF64F1000-memory.dmp

    Filesize

    68KB

  • memory/824-91-0x000007FEF6490000-0x000007FEF64B1000-memory.dmp

    Filesize

    132KB

  • memory/824-90-0x000007FEF64C0000-0x000007FEF64D2000-memory.dmp

    Filesize

    72KB

  • memory/824-92-0x000007FEF6470000-0x000007FEF6483000-memory.dmp

    Filesize

    76KB

  • memory/824-93-0x000007FEF4FF0000-0x000007FEF5168000-memory.dmp

    Filesize

    1.5MB

  • memory/824-94-0x000007FEF4FD0000-0x000007FEF4FE7000-memory.dmp

    Filesize

    92KB

  • memory/824-95-0x000007FEFB0B0000-0x000007FEFB0C0000-memory.dmp

    Filesize

    64KB

  • memory/824-96-0x000007FEF4FA0000-0x000007FEF4FCF000-memory.dmp

    Filesize

    188KB

  • memory/824-97-0x000007FEF4F80000-0x000007FEF4F91000-memory.dmp

    Filesize

    68KB

  • memory/824-98-0x000007FEF4F60000-0x000007FEF4F76000-memory.dmp

    Filesize

    88KB

  • memory/824-99-0x000007FEF4F40000-0x000007FEF4F55000-memory.dmp

    Filesize

    84KB

  • memory/824-102-0x000007FEF6940000-0x000007FEF6BF4000-memory.dmp

    Filesize

    2.7MB

  • memory/824-111-0x000007FEF5170000-0x000007FEF621B000-memory.dmp

    Filesize

    16.7MB