Overview
overview
7Static
static
7samp.apk
android-9-x86
1360Default...20.cfg
windows7-x64
3360Default...20.cfg
windows10-2004-x64
3360Default960x720.cfg
windows7-x64
3360Default960x720.cfg
windows10-2004-x64
3BRADLEYHAN...LD.ttf
windows7-x64
3BRADLEYHAN...LD.ttf
windows10-2004-x64
7ChaletComp...ty.otf
windows7-x64
3ChaletComp...ty.otf
windows10-2004-x64
7GTALICENSE...AR.ttf
windows7-x64
3GTALICENSE...AR.ttf
windows10-2004-x64
7HELVETICAN...ND.ttf
windows7-x64
3HELVETICAN...ND.ttf
windows10-2004-x64
7HELVETICAN...ND.ttf
windows7-x64
3HELVETICAN...ND.ttf
windows10-2004-x64
7HELVETICAN...MD.ttf
windows7-x64
3HELVETICAN...MD.ttf
windows10-2004-x64
7HELVETICAN...CN.ttf
windows7-x64
3HELVETICAN...CN.ttf
windows10-2004-x64
7HELVETICAN...CN.ttf
windows7-x64
3HELVETICAN...CN.ttf
windows10-2004-x64
7HELVETICAN...ND.ttf
windows7-x64
3HELVETICAN...ND.ttf
windows10-2004-x64
7HELVETICAN...AN.otf
windows7-x64
3HELVETICAN...AN.otf
windows10-2004-x64
7JapaneseFont.met
windows7-x64
3JapaneseFont.met
windows10-2004-x64
3JapaneseFont.png
windows7-x64
3JapaneseFont.png
windows10-2004-x64
3NAV_DOWN.ogg
windows7-x64
1NAV_DOWN.ogg
windows10-2004-x64
7NAV_UP.ogg
windows7-x64
1Analysis
-
max time kernel
151s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20230621-en -
resource tags
arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system -
submitted
04-07-2023 05:38
Static task
static1
Behavioral task
behavioral1
Sample
samp.apk
Resource
android-x86-arm-20230621-en
Behavioral task
behavioral2
Sample
360Default1280x720.cfg
Resource
win7-20230703-en
Behavioral task
behavioral3
Sample
360Default1280x720.cfg
Resource
win10v2004-20230703-en
Behavioral task
behavioral4
Sample
360Default960x720.cfg
Resource
win7-20230703-en
Behavioral task
behavioral5
Sample
360Default960x720.cfg
Resource
win10v2004-20230621-en
Behavioral task
behavioral6
Sample
BRADLEYHANDITCTTBOLD.ttf
Resource
win7-20230703-en
Behavioral task
behavioral7
Sample
BRADLEYHANDITCTTBOLD.ttf
Resource
win10v2004-20230703-en
Behavioral task
behavioral8
Sample
ChaletComprime-CologneSixty.otf
Resource
win7-20230703-en
Behavioral task
behavioral9
Sample
ChaletComprime-CologneSixty.otf
Resource
win10v2004-20230703-en
Behavioral task
behavioral10
Sample
GTALICENSE-REGULAR.ttf
Resource
win7-20230703-en
Behavioral task
behavioral11
Sample
GTALICENSE-REGULAR.ttf
Resource
win10v2004-20230703-en
Behavioral task
behavioral12
Sample
HELVETICANEUELT-LIGHTCOND.ttf
Resource
win7-20230703-en
Behavioral task
behavioral13
Sample
HELVETICANEUELT-LIGHTCOND.ttf
Resource
win10v2004-20230621-en
Behavioral task
behavioral14
Sample
HELVETICANEUELT-MEDIUMCOND.ttf
Resource
win7-20230703-en
Behavioral task
behavioral15
Sample
HELVETICANEUELT-MEDIUMCOND.ttf
Resource
win10v2004-20230703-en
Behavioral task
behavioral16
Sample
HELVETICANEUELTCOM-MD.ttf
Resource
win7-20230703-en
Behavioral task
behavioral17
Sample
HELVETICANEUELTCOM-MD.ttf
Resource
win10v2004-20230703-en
Behavioral task
behavioral18
Sample
HELVETICANEUELTCOM-MDCN.ttf
Resource
win7-20230703-en
Behavioral task
behavioral19
Sample
HELVETICANEUELTCOM-MDCN.ttf
Resource
win10v2004-20230703-en
Behavioral task
behavioral20
Sample
HELVETICANEUELTCYR-LIGHTCN.ttf
Resource
win7-20230703-en
Behavioral task
behavioral21
Sample
HELVETICANEUELTCYR-LIGHTCN.ttf
Resource
win10v2004-20230621-en
Behavioral task
behavioral22
Sample
HELVETICANEUELTCYR-MDCOND.ttf
Resource
win7-20230703-en
Behavioral task
behavioral23
Sample
HELVETICANEUELTCYR-MDCOND.ttf
Resource
win10v2004-20230703-en
Behavioral task
behavioral24
Sample
HELVETICANEUELTW1G-ROMAN.otf
Resource
win7-20230703-en
Behavioral task
behavioral25
Sample
HELVETICANEUELTW1G-ROMAN.otf
Resource
win10v2004-20230703-en
Behavioral task
behavioral26
Sample
JapaneseFont.met
Resource
win7-20230703-en
Behavioral task
behavioral27
Sample
JapaneseFont.met
Resource
win10v2004-20230703-en
Behavioral task
behavioral28
Sample
JapaneseFont.png
Resource
win7-20230703-en
Behavioral task
behavioral29
Sample
JapaneseFont.png
Resource
win10v2004-20230703-en
Behavioral task
behavioral30
Sample
NAV_DOWN.ogg
Resource
win7-20230621-en
Behavioral task
behavioral31
Sample
NAV_DOWN.ogg
Resource
win10v2004-20230703-en
Behavioral task
behavioral32
Sample
NAV_UP.ogg
Resource
win7-20230703-en
General
-
Target
NAV_DOWN.ogg
-
Size
5KB
-
MD5
e7977c345b60b12e15e335007f80105f
-
SHA1
dbb3d2d9a6dade78ece9395135838617e07bf01b
-
SHA256
e40ff9f9230e63d923076dbf4a29775490c3efe48b6c0bb520be164cbe638bbd
-
SHA512
ac6b4c4498464d333c1481ba9eac2302217ea5cfec14faa57fe87099262e7c43cd2ea84d69d680b015647a3eed5783c2addda06add730496098969086d352c65
-
SSDEEP
96:KRSatuKjmRBOx1OoThgkvWoaKi5JrPNalPPPPPPPPPPPPPPPPPPPPPHq0QPPPPPp:ctoKa3o1hFgkFaKwJ7I0j9Y3WXd/iFWB
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1312 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1312 vlc.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: 33 560 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 560 AUDIODG.EXE Token: 33 560 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 560 AUDIODG.EXE Token: 33 1312 vlc.exe Token: SeIncBasePriorityPrivilege 1312 vlc.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 1312 vlc.exe 1312 vlc.exe 1312 vlc.exe 1312 vlc.exe 1312 vlc.exe 1312 vlc.exe 1312 vlc.exe 1312 vlc.exe -
Suspicious use of SendNotifyMessage 7 IoCs
pid Process 1312 vlc.exe 1312 vlc.exe 1312 vlc.exe 1312 vlc.exe 1312 vlc.exe 1312 vlc.exe 1312 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1312 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\NAV_DOWN.ogg"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1312
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0xc41⤵
- Suspicious use of AdjustPrivilegeToken
PID:560