Overview
overview
7Static
static
7Changed.v0...21.rar
windows7-x64
3Changed.v0...21.rar
windows10-2004-x64
3Changed Sp...er.ini
windows7-x64
1Changed Sp...er.ini
windows10-2004-x64
1Changed Sp...ve.txt
windows7-x64
1Changed Sp...ve.txt
windows10-2004-x64
1Changed Sp...me.txt
windows7-x64
1Changed Sp...me.txt
windows10-2004-x64
1Changed Sp...ge.txt
windows7-x64
1Changed Sp...ge.txt
windows10-2004-x64
1Changed Sp...rt.txt
windows7-x64
1Changed Sp...rt.txt
windows10-2004-x64
1Changed Sp...id.txt
windows7-x64
1Changed Sp...id.txt
windows10-2004-x64
1Changed Sp...id.txt
windows7-x64
1Changed Sp...id.txt
windows10-2004-x64
1Changed Sp.../1.wav
windows7-x64
1Changed Sp.../1.wav
windows10-2004-x64
6Changed Sp...10.wav
windows7-x64
1Changed Sp...10.wav
windows10-2004-x64
6Changed Sp...11.wav
windows7-x64
1Changed Sp...11.wav
windows10-2004-x64
6Changed Sp...12.wav
windows7-x64
1Changed Sp...12.wav
windows10-2004-x64
6Changed Sp...13.wav
windows7-x64
1Changed Sp...13.wav
windows10-2004-x64
6Changed Sp...14.wav
windows7-x64
1Changed Sp...14.wav
windows10-2004-x64
6Changed Sp...15.wav
windows7-x64
1Changed Sp...15.wav
windows10-2004-x64
6Changed Sp...16.wav
windows7-x64
1Changed Sp...16.wav
windows10-2004-x64
6Analysis
-
max time kernel
147s -
max time network
36s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
10-06-2023 13:46
Behavioral task
behavioral1
Sample
Changed.v01.02.2021.rar
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Changed.v01.02.2021.rar
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
Changed Special/coldclientloader.ini
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
Changed Special/coldclientloader.ini
Resource
win10v2004-20230221-en
Behavioral task
behavioral5
Sample
Changed Special/local_save.txt
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
Changed Special/local_save.txt
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
Changed Special/steam_settings/settings/account_name.txt
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
Changed Special/steam_settings/settings/account_name.txt
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
Changed Special/steam_settings/settings/language.txt
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
Changed Special/steam_settings/settings/language.txt
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
Changed Special/steam_settings/settings/listen_port.txt
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
Changed Special/steam_settings/settings/listen_port.txt
Resource
win10v2004-20230221-en
Behavioral task
behavioral13
Sample
Changed Special/steam_settings/settings/user_steam_id.txt
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
Changed Special/steam_settings/settings/user_steam_id.txt
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
Changed Special/steam_settings/steam_appid.txt
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
Changed Special/steam_settings/steam_appid.txt
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/1.wav
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/1.wav
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/10.wav
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/10.wav
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/11.wav
Resource
win7-20230220-en
Behavioral task
behavioral22
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/11.wav
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/12.wav
Resource
win7-20230220-en
Behavioral task
behavioral24
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/12.wav
Resource
win10v2004-20230220-en
Behavioral task
behavioral25
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/13.wav
Resource
win7-20230220-en
Behavioral task
behavioral26
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/13.wav
Resource
win10v2004-20230220-en
Behavioral task
behavioral27
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/14.wav
Resource
win7-20230220-en
Behavioral task
behavioral28
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/14.wav
Resource
win10v2004-20230220-en
Behavioral task
behavioral29
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/15.wav
Resource
win7-20230220-en
Behavioral task
behavioral30
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/15.wav
Resource
win10v2004-20230221-en
Behavioral task
behavioral31
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/16.wav
Resource
win7-20230220-en
Behavioral task
behavioral32
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/16.wav
Resource
win10v2004-20230220-en
General
-
Target
Changed Special/steamapps/common/Changed Special/Audio/BGM/11.wav
-
Size
2.7MB
-
MD5
1e20e5cb1b3d3bfd5939159dd53a53d7
-
SHA1
43021ca542dee2f88116033989a6ba5e5c842bda
-
SHA256
5fa7a87d00c3784abb9a43c2e097ab9b379b4e881ece992ac41c22b1b4b5b9b1
-
SHA512
dea5d77e44f53d7edf143e6eab57b83c08a6ca96a5d69fa6d5deff53d10ef3546c5f7d565e705f99d2db73d4f027f8919f377849c4ad63cf7d95bdbc563e8eac
-
SSDEEP
49152:bee9LVEUxT3iLP76gcaFVD9BOcRNLBTk7QPPWA6HvZ7bPgly+JNmb6z4+NjxeQU3:6gCgTiugTz54GNLOAgPgDoF3
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
vlc.exepid process 1288 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
vlc.exepid process 1288 vlc.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
AUDIODG.EXEvlc.exedescription pid process Token: 33 520 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 520 AUDIODG.EXE Token: 33 520 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 520 AUDIODG.EXE Token: 33 1288 vlc.exe Token: SeIncBasePriorityPrivilege 1288 vlc.exe -
Suspicious use of FindShellTrayWindow 9 IoCs
Processes:
vlc.exepid process 1288 vlc.exe 1288 vlc.exe 1288 vlc.exe 1288 vlc.exe 1288 vlc.exe 1288 vlc.exe 1288 vlc.exe 1288 vlc.exe 1288 vlc.exe -
Suspicious use of SendNotifyMessage 8 IoCs
Processes:
vlc.exepid process 1288 vlc.exe 1288 vlc.exe 1288 vlc.exe 1288 vlc.exe 1288 vlc.exe 1288 vlc.exe 1288 vlc.exe 1288 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vlc.exepid process 1288 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Changed Special\steamapps\common\Changed Special\Audio\BGM\11.wav"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4c81⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1288-59-0x000000013F4E0000-0x000000013F5D8000-memory.dmpFilesize
992KB
-
memory/1288-60-0x000007FEF75C0000-0x000007FEF75F4000-memory.dmpFilesize
208KB
-
memory/1288-61-0x000007FEF6B90000-0x000007FEF6E44000-memory.dmpFilesize
2.7MB
-
memory/1288-67-0x000007FEF6F80000-0x000007FEF6F9D000-memory.dmpFilesize
116KB
-
memory/1288-66-0x000007FEF6FA0000-0x000007FEF6FB1000-memory.dmpFilesize
68KB
-
memory/1288-68-0x000007FEF6910000-0x000007FEF6B10000-memory.dmpFilesize
2.0MB
-
memory/1288-69-0x000007FEF6B70000-0x000007FEF6B81000-memory.dmpFilesize
68KB
-
memory/1288-65-0x000007FEF6FC0000-0x000007FEF6FD7000-memory.dmpFilesize
92KB
-
memory/1288-72-0x000007FEF6B50000-0x000007FEF6B68000-memory.dmpFilesize
96KB
-
memory/1288-71-0x000007FEF68A0000-0x000007FEF68C1000-memory.dmpFilesize
132KB
-
memory/1288-70-0x000007FEF68D0000-0x000007FEF690F000-memory.dmpFilesize
252KB
-
memory/1288-64-0x000007FEF6FE0000-0x000007FEF6FF1000-memory.dmpFilesize
68KB
-
memory/1288-63-0x000007FEF75A0000-0x000007FEF75B7000-memory.dmpFilesize
92KB
-
memory/1288-62-0x000007FEFBF70000-0x000007FEFBF88000-memory.dmpFilesize
96KB
-
memory/1288-75-0x000007FEF57B0000-0x000007FEF57C1000-memory.dmpFilesize
68KB
-
memory/1288-82-0x000007FEF5620000-0x000007FEF568F000-memory.dmpFilesize
444KB
-
memory/1288-83-0x000007FEF5600000-0x000007FEF5611000-memory.dmpFilesize
68KB
-
memory/1288-84-0x000007FEF55A0000-0x000007FEF55F6000-memory.dmpFilesize
344KB
-
memory/1288-85-0x000007FEF5570000-0x000007FEF5598000-memory.dmpFilesize
160KB
-
memory/1288-86-0x000007FEF5540000-0x000007FEF5564000-memory.dmpFilesize
144KB
-
memory/1288-87-0x000007FEF5520000-0x000007FEF5537000-memory.dmpFilesize
92KB
-
memory/1288-88-0x000007FEF54F0000-0x000007FEF5513000-memory.dmpFilesize
140KB
-
memory/1288-89-0x000007FEF54D0000-0x000007FEF54E1000-memory.dmpFilesize
68KB
-
memory/1288-90-0x000007FEF54B0000-0x000007FEF54C2000-memory.dmpFilesize
72KB
-
memory/1288-92-0x000007FEF5460000-0x000007FEF5473000-memory.dmpFilesize
76KB
-
memory/1288-95-0x000007FEFAE60000-0x000007FEFAE70000-memory.dmpFilesize
64KB
-
memory/1288-96-0x000007FEF5290000-0x000007FEF52BF000-memory.dmpFilesize
188KB
-
memory/1288-97-0x000007FEF5270000-0x000007FEF5281000-memory.dmpFilesize
68KB
-
memory/1288-98-0x000007FEF5250000-0x000007FEF5266000-memory.dmpFilesize
88KB
-
memory/1288-99-0x000007FEF5230000-0x000007FEF5245000-memory.dmpFilesize
84KB
-
memory/1288-100-0x000007FEF4EF0000-0x000007FEF4F01000-memory.dmpFilesize
68KB
-
memory/1288-101-0x000007FEF4ED0000-0x000007FEF4EE2000-memory.dmpFilesize
72KB
-
memory/1288-94-0x000007FEF52C0000-0x000007FEF52D7000-memory.dmpFilesize
92KB
-
memory/1288-93-0x000007FEF52E0000-0x000007FEF5458000-memory.dmpFilesize
1.5MB
-
memory/1288-91-0x000007FEF5480000-0x000007FEF54A1000-memory.dmpFilesize
132KB
-
memory/1288-102-0x000007FEF4D50000-0x000007FEF4ECA000-memory.dmpFilesize
1.5MB
-
memory/1288-103-0x000007FEF4D30000-0x000007FEF4D43000-memory.dmpFilesize
76KB
-
memory/1288-108-0x000007FEF4C90000-0x000007FEF4CA6000-memory.dmpFilesize
88KB
-
memory/1288-107-0x000007FEF4CB0000-0x000007FEF4CC1000-memory.dmpFilesize
68KB
-
memory/1288-106-0x000007FEF4CD0000-0x000007FEF4CE1000-memory.dmpFilesize
68KB
-
memory/1288-105-0x000007FEF4CF0000-0x000007FEF4D01000-memory.dmpFilesize
68KB
-
memory/1288-104-0x000007FEF4D10000-0x000007FEF4D24000-memory.dmpFilesize
80KB
-
memory/1288-81-0x000007FEF5690000-0x000007FEF56F7000-memory.dmpFilesize
412KB
-
memory/1288-80-0x000007FEF5700000-0x000007FEF5730000-memory.dmpFilesize
192KB
-
memory/1288-79-0x000007FEF5730000-0x000007FEF5748000-memory.dmpFilesize
96KB
-
memory/1288-78-0x000007FEF5750000-0x000007FEF5761000-memory.dmpFilesize
68KB
-
memory/1288-77-0x000007FEF5770000-0x000007FEF578B000-memory.dmpFilesize
108KB
-
memory/1288-76-0x000007FEF5790000-0x000007FEF57A1000-memory.dmpFilesize
68KB
-
memory/1288-74-0x000007FEF57D0000-0x000007FEF57E1000-memory.dmpFilesize
68KB
-
memory/1288-73-0x000007FEF57F0000-0x000007FEF689B000-memory.dmpFilesize
16.7MB
-
memory/1288-111-0x000007FEF6B90000-0x000007FEF6E44000-memory.dmpFilesize
2.7MB