Overview
overview
6Static
static
3SugarySpir...02.rar
windows7-x64
3SugarySpir...02.rar
windows10-2004-x64
3SugarySpir...re.exe
windows7-x64
1SugarySpir...re.exe
windows10-2004-x64
1SugarySpir...ta.win
windows7-x64
3SugarySpir...ta.win
windows10-2004-x64
3SugarySpir...ro.mp4
windows7-x64
1SugarySpir...ro.mp4
windows10-2004-x64
6SugarySpir...ns.ini
windows7-x64
1SugarySpir...ns.ini
windows10-2004-x64
1SugarySpir...ce.dll
windows7-x64
1SugarySpir...ce.dll
windows10-2004-x64
3Analysis
-
max time kernel
17s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
04/06/2023, 10:51
Static task
static1
Behavioral task
behavioral1
Sample
SugarySpire_Dance_And_Cafe_Test_V1.02.rar
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
SugarySpire_Dance_And_Cafe_Test_V1.02.rar
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
SugarySpire_Dance_And_Cafe_Test_V1.02/SugarySpire.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
SugarySpire_Dance_And_Cafe_Test_V1.02/SugarySpire.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
SugarySpire_Dance_And_Cafe_Test_V1.02/data.win
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
SugarySpire_Dance_And_Cafe_Test_V1.02/data.win
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
SugarySpire_Dance_And_Cafe_Test_V1.02/gamedata/intro.mp4
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
SugarySpire_Dance_And_Cafe_Test_V1.02/gamedata/intro.mp4
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
SugarySpire_Dance_And_Cafe_Test_V1.02/options.ini
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
SugarySpire_Dance_And_Cafe_Test_V1.02/options.ini
Resource
win10v2004-20230221-en
Behavioral task
behavioral11
Sample
SugarySpire_Dance_And_Cafe_Test_V1.02/rousrDissonance.dll
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
SugarySpire_Dance_And_Cafe_Test_V1.02/rousrDissonance.dll
Resource
win10v2004-20230220-en
General
-
Target
SugarySpire_Dance_And_Cafe_Test_V1.02/gamedata/intro.mp4
-
Size
26.7MB
-
MD5
381266f71b3b8bc2cf879b0b3896e517
-
SHA1
2b6d96e8a56d43222b186bbdbbdac9ffd062f513
-
SHA256
b332adeb1831e507dbf5f79a997075beb5066555f489cbf911a270d6fb67e1db
-
SHA512
c08781ec8c0c7b8acb33a23b881c72fc6348293cd7d0f13b87e646d744f0bf8cb81b9e2f08e09b64306f9c28b514bda7d76dc58fb7d8372cd378ec3014a0cce2
-
SSDEEP
786432:ANoGecJwAsqoLIAhF2IkTPnbQNWWw3xJoI8:C/VwFjVpkbjBGI8
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 924 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 924 vlc.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: 33 1536 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1536 AUDIODG.EXE Token: 33 1536 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1536 AUDIODG.EXE Token: 33 924 vlc.exe Token: SeIncBasePriorityPrivilege 924 vlc.exe -
Suspicious use of FindShellTrayWindow 30 IoCs
pid Process 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe -
Suspicious use of SendNotifyMessage 10 IoCs
pid Process 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 924 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\SugarySpire_Dance_And_Cafe_Test_V1.02\gamedata\intro.mp4"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:924
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5601⤵
- Suspicious use of AdjustPrivilegeToken
PID:1536