Analysis

  • max time kernel
    143s
  • max time network
    196s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/07/2023, 22:36

General

  • Target

    assets/sounds/Lights_Shut_off.ogg

  • Size

    54KB

  • MD5

    4bbd83f50c175f7bf489cfc6be71e52b

  • SHA1

    3febdc21fe88d1adc800d3cd2cf2fd89785606f4

  • SHA256

    3787135c2c72607577572b915cfd04a32a7c44669fade5540cc876e8eda39c2b

  • SHA512

    5f06bf945ced7f7014209c144f57372f9ea254221ab1e22fca0e373236bdaa05ae33cdd81c94c8f1807fe07d5a172b006810fc419a4b13294999591aab15d3be

  • SSDEEP

    768:x4P0PLLGeWY6dEMFD6JB0yv80U3P5OBJsA0KX72/zVO/JFOcI6ioWJf8xQGj9/Ne:hdWQMQytIJsAVCrVqFOsWJfW/NJTCEiJ

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\assets\sounds\Lights_Shut_off.ogg
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3940
    • C:\Program Files\VideoLAN\VLC\vlc.exe
      "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\assets\sounds\Lights_Shut_off.ogg"
      2⤵
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:3148
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x300 0x40c
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1424

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/3148-133-0x00007FF6EE700000-0x00007FF6EE7F8000-memory.dmp

          Filesize

          992KB

        • memory/3148-134-0x00007FFE06DA0000-0x00007FFE06DD4000-memory.dmp

          Filesize

          208KB

        • memory/3148-135-0x00007FFDF6A70000-0x00007FFDF6D24000-memory.dmp

          Filesize

          2.7MB

        • memory/3148-136-0x00007FFE0ED10000-0x00007FFE0ED28000-memory.dmp

          Filesize

          96KB

        • memory/3148-137-0x00007FFE05CD0000-0x00007FFE05CE7000-memory.dmp

          Filesize

          92KB

        • memory/3148-138-0x00007FFE0DEB0000-0x00007FFE0DEC1000-memory.dmp

          Filesize

          68KB

        • memory/3148-139-0x00007FFE0DE90000-0x00007FFE0DEA7000-memory.dmp

          Filesize

          92KB

        • memory/3148-140-0x00007FFE0DE70000-0x00007FFE0DE81000-memory.dmp

          Filesize

          68KB

        • memory/3148-141-0x00007FFE0DE50000-0x00007FFE0DE6D000-memory.dmp

          Filesize

          116KB

        • memory/3148-142-0x00007FFE0DE30000-0x00007FFE0DE41000-memory.dmp

          Filesize

          68KB

        • memory/3148-143-0x00007FFDF56E0000-0x00007FFDF678B000-memory.dmp

          Filesize

          16.7MB

        • memory/3148-151-0x00007FFDF6A70000-0x00007FFDF6D24000-memory.dmp

          Filesize

          2.7MB

        • memory/3148-159-0x00007FFDF56E0000-0x00007FFDF678B000-memory.dmp

          Filesize

          16.7MB

        • memory/3148-160-0x00007FFDF54E0000-0x00007FFDF56E0000-memory.dmp

          Filesize

          2.0MB

        • memory/3148-161-0x00007FFE0DDF0000-0x00007FFE0DE2F000-memory.dmp

          Filesize

          252KB

        • memory/3148-163-0x00007FFE0DDA0000-0x00007FFE0DDB8000-memory.dmp

          Filesize

          96KB

        • memory/3148-164-0x00007FFE0DD80000-0x00007FFE0DD91000-memory.dmp

          Filesize

          68KB

        • memory/3148-162-0x00007FFE0DDC0000-0x00007FFE0DDE1000-memory.dmp

          Filesize

          132KB

        • memory/3148-166-0x00007FFE05A70000-0x00007FFE05A81000-memory.dmp

          Filesize

          68KB

        • memory/3148-165-0x00007FFE0D230000-0x00007FFE0D241000-memory.dmp

          Filesize

          68KB

        • memory/3148-168-0x00007FFDF7330000-0x00007FFDF7341000-memory.dmp

          Filesize

          68KB

        • memory/3148-170-0x00007FFDF72E0000-0x00007FFDF7310000-memory.dmp

          Filesize

          192KB

        • memory/3148-169-0x00007FFDF7310000-0x00007FFDF7328000-memory.dmp

          Filesize

          96KB

        • memory/3148-167-0x00007FFDFD070000-0x00007FFDFD08B000-memory.dmp

          Filesize

          108KB

        • memory/3148-171-0x00007FFDF7270000-0x00007FFDF72D7000-memory.dmp

          Filesize

          412KB

        • memory/3148-172-0x00007FFDF6A00000-0x00007FFDF6A6F000-memory.dmp

          Filesize

          444KB

        • memory/3148-173-0x00007FFDF7250000-0x00007FFDF7261000-memory.dmp

          Filesize

          68KB

        • memory/3148-174-0x00007FFDF5480000-0x00007FFDF54DC000-memory.dmp

          Filesize

          368KB

        • memory/3148-175-0x00007FFDF5420000-0x00007FFDF5476000-memory.dmp

          Filesize

          344KB

        • memory/3148-176-0x00007FFDF69D0000-0x00007FFDF69F8000-memory.dmp

          Filesize

          160KB

        • memory/3148-177-0x00007FFDF53F0000-0x00007FFDF5414000-memory.dmp

          Filesize

          144KB

        • memory/3148-183-0x00007FFDF5330000-0x00007FFDF5343000-memory.dmp

          Filesize

          76KB

        • memory/3148-184-0x00007FFDF5310000-0x00007FFDF5322000-memory.dmp

          Filesize

          72KB

        • memory/3148-182-0x00007FFDF5350000-0x00007FFDF5371000-memory.dmp

          Filesize

          132KB

        • memory/3148-181-0x00007FFDF5380000-0x00007FFDF5392000-memory.dmp

          Filesize

          72KB

        • memory/3148-180-0x00007FFDF53A0000-0x00007FFDF53B1000-memory.dmp

          Filesize

          68KB

        • memory/3148-179-0x00007FFDF53C0000-0x00007FFDF53E3000-memory.dmp

          Filesize

          140KB

        • memory/3148-178-0x00007FFDF69B0000-0x00007FFDF69C7000-memory.dmp

          Filesize

          92KB

        • memory/3148-186-0x00007FFDF51A0000-0x00007FFDF51CC000-memory.dmp

          Filesize

          176KB

        • memory/3148-185-0x00007FFDF51D0000-0x00007FFDF530B000-memory.dmp

          Filesize

          1.2MB

        • memory/3148-187-0x00007FFDF4FE0000-0x00007FFDF5192000-memory.dmp

          Filesize

          1.7MB

        • memory/3148-189-0x00007FFDF4F20000-0x00007FFDF4FB7000-memory.dmp

          Filesize

          604KB

        • memory/3148-188-0x00007FFDF4FC0000-0x00007FFDF4FD1000-memory.dmp

          Filesize

          68KB

        • memory/3148-190-0x00007FFDF4F00000-0x00007FFDF4F12000-memory.dmp

          Filesize

          72KB

        • memory/3148-191-0x00007FFDF4CC0000-0x00007FFDF4EF1000-memory.dmp

          Filesize

          2.2MB

        • memory/3148-192-0x00007FFDF4C80000-0x00007FFDF4CB5000-memory.dmp

          Filesize

          212KB

        • memory/3148-194-0x00007FFDF4C30000-0x00007FFDF4C41000-memory.dmp

          Filesize

          68KB

        • memory/3148-193-0x00007FFDF4C50000-0x00007FFDF4C75000-memory.dmp

          Filesize

          148KB

        • memory/3148-195-0x00007FFDF4BC0000-0x00007FFDF4C21000-memory.dmp

          Filesize

          388KB

        • memory/3148-196-0x00007FFDF4BA0000-0x00007FFDF4BB1000-memory.dmp

          Filesize

          68KB

        • memory/3148-197-0x00007FFDF4B80000-0x00007FFDF4B92000-memory.dmp

          Filesize

          72KB

        • memory/3148-198-0x00007FFDF4B60000-0x00007FFDF4B73000-memory.dmp

          Filesize

          76KB

        • memory/3148-199-0x00007FFDF4AC0000-0x00007FFDF4B5F000-memory.dmp

          Filesize

          636KB

        • memory/3148-200-0x00007FFDF4AA0000-0x00007FFDF4AB1000-memory.dmp

          Filesize

          68KB

        • memory/3148-201-0x00007FFDF4990000-0x00007FFDF4A92000-memory.dmp

          Filesize

          1.0MB