Overview
overview
7Static
static
7Project 64.rar
windows7-x64
3Project 64.rar
windows10-2004-x64
3Project 64...ge.url
windows7-x64
1Project 64...ge.url
windows10-2004-x64
1Project 64....3.vbs
windows7-x64
1Project 64....3.vbs
windows10-2004-x64
1Project 64...rd.url
windows7-x64
1Project 64...rd.url
windows10-2004-x64
1Project 64...AQ.chm
windows7-x64
1Project 64...AQ.chm
windows10-2004-x64
1Project 64..._0.dll
windows7-x64
1Project 64..._0.dll
windows10-2004-x64
1Project 64...ut.dll
windows7-x64
1Project 64...ut.dll
windows10-2004-x64
3Project 64...D6.dll
windows7-x64
1Project 64...D6.dll
windows10-2004-x64
3Project 64...D8.dll
windows7-x64
1Project 64...D8.dll
windows10-2004-x64
3Project 64...nd.dll
windows7-x64
1Project 64...nd.dll
windows10-2004-x64
3Project 64...V2.dll
windows7-x64
1Project 64...V2.dll
windows10-2004-x64
1Project 64...nd.dll
windows7-x64
1Project 64...nd.dll
windows10-2004-x64
1Project 64...SP.dll
windows7-x64
1Project 64...SP.dll
windows10-2004-x64
3Project 64...io.dll
windows7-x64
3Project 64...io.dll
windows10-2004-x64
3Project 64...64.chm
windows7-x64
1Project 64...64.chm
windows10-2004-x64
1Project 64...64.exe
windows7-x64
1Project 64...64.exe
windows10-2004-x64
1Analysis
-
max time kernel
21s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
14-05-2023 17:43
Behavioral task
behavioral1
Sample
Project 64.rar
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral2
Sample
Project 64.rar
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Project 64/Project64 1.6/Docs/3rd Party Plugins/N-Rage/Homepage.url
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral4
Sample
Project 64/Project64 1.6/Docs/3rd Party Plugins/N-Rage/Homepage.url
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Project 64/Project64 1.6/Docs/Plugin Specs/Gfx #1.3.vbs
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral6
Sample
Project 64/Project64 1.6/Docs/Plugin Specs/Gfx #1.3.vbs
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Project 64/Project64 1.6/Docs/Project64 Message Board.url
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral8
Sample
Project 64/Project64 1.6/Docs/Project64 Message Board.url
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Project 64/Project64 1.6/PJgameFAQ.chm
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral10
Sample
Project 64/Project64 1.6/PJgameFAQ.chm
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Project 64/Project64 1.6/Plugin/Adaptoid_v1_0.dll
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral12
Sample
Project 64/Project64 1.6/Plugin/Adaptoid_v1_0.dll
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Project 64/Project64 1.6/Plugin/Jabo_DInput.dll
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral14
Sample
Project 64/Project64 1.6/Plugin/Jabo_DInput.dll
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Project 64/Project64 1.6/Plugin/Jabo_Direct3D6.dll
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral16
Sample
Project 64/Project64 1.6/Plugin/Jabo_Direct3D6.dll
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Project 64/Project64 1.6/Plugin/Jabo_Direct3D8.dll
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral18
Sample
Project 64/Project64 1.6/Plugin/Jabo_Direct3D8.dll
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Project 64/Project64 1.6/Plugin/Jabo_Dsound.dll
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral20
Sample
Project 64/Project64 1.6/Plugin/Jabo_Dsound.dll
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Project 64/Project64 1.6/Plugin/NRage_DInput8_V2.dll
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral22
Sample
Project 64/Project64 1.6/Plugin/NRage_DInput8_V2.dll
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
Project 64/Project64 1.6/Plugin/No Sound.dll
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral24
Sample
Project 64/Project64 1.6/Plugin/No Sound.dll
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
Project 64/Project64 1.6/Plugin/RSP.dll
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral26
Sample
Project 64/Project64 1.6/Plugin/RSP.dll
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
Project 64/Project64 1.6/Plugin/Zilmar_Audio.dll
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral28
Sample
Project 64/Project64 1.6/Plugin/Zilmar_Audio.dll
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
Project 64/Project64 1.6/Project64.chm
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral30
Sample
Project 64/Project64 1.6/Project64.chm
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
Project 64/Project64 1.6/Project64.exe
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral32
Sample
Project 64/Project64 1.6/Project64.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
General
-
Target
Project 64.rar
-
Size
43.7MB
-
MD5
8316e6794e641aca8b2fb89462208a78
-
SHA1
a5b45da2a60607cc0fb6795976fc9d517d7e9ab6
-
SHA256
f216c50f1d670afa8f530f85d431580901914c3780b2b6a25fd4cdd0b4c6d8da
-
SHA512
b19e6bd622328869a5869868203af582880bec51064e9585bc85ba3c291feddaf075303f7bfd45f1ca4b0b165ec856b9349b32ed38ccdfb05e3264409daf2838
-
SSDEEP
786432:u2a3BWGM3L7q08ZV2Bela1dj0Xvw3jK6umY8pVcRpC7m5c8G:i3JM/q08Zocla0SjK69qC7m5xG
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache rundll32.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1412 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 688 rundll32.exe 1412 vlc.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: 33 920 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 920 AUDIODG.EXE Token: 33 920 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 920 AUDIODG.EXE Token: 33 1412 vlc.exe Token: SeIncBasePriorityPrivilege 1412 vlc.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe 1412 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1412 vlc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2040 wrote to memory of 688 2040 cmd.exe 29 PID 2040 wrote to memory of 688 2040 cmd.exe 29 PID 2040 wrote to memory of 688 2040 cmd.exe 29 PID 688 wrote to memory of 1412 688 rundll32.exe 30 PID 688 wrote to memory of 1412 688 rundll32.exe 30 PID 688 wrote to memory of 1412 688 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Project 64.rar"1⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Project 64.rar2⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Project 64.rar"3⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1412
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5501⤵
- Suspicious use of AdjustPrivilegeToken
PID:920