Analysis

  • max time kernel
    142s
  • max time network
    200s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/07/2023, 22:36

General

  • Target

    assets/sounds/Senpai_Dies.ogg

  • Size

    133KB

  • MD5

    a94285ffad660e52f6e36f6b6a7aa92b

  • SHA1

    d961ef669dcb5294fd1d0aa4ced2c38500fdd483

  • SHA256

    2cd47eda44f0dc2bfb3191188b5335802a7de2af3b1928da5262d331da2c0b1d

  • SHA512

    579eba472f8a1b2decdd670d9489f45d1d2337c7627348c0e5e5263660bf82bdce752a3f99892c86554fa6a771efe59ef7ab5fb42ad690cd07d020f6fc74f835

  • SSDEEP

    3072:CGX38hQBUgGpIPmVEc8T33Zj+lw0/D+r7ffXuvU:l38hIUgGpAmVezpj+lwmD+rTWvU

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\assets\sounds\Senpai_Dies.ogg
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2936
    • C:\Program Files\VideoLAN\VLC\vlc.exe
      "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\assets\sounds\Senpai_Dies.ogg"
      2⤵
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:4124
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x408 0x410
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:556

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/4124-138-0x00007FF7BB110000-0x00007FF7BB208000-memory.dmp

          Filesize

          992KB

        • memory/4124-139-0x00007FF9B7090000-0x00007FF9B70C4000-memory.dmp

          Filesize

          208KB

        • memory/4124-140-0x00007FF9A70F0000-0x00007FF9A73A4000-memory.dmp

          Filesize

          2.7MB

        • memory/4124-141-0x00007FF9B76D0000-0x00007FF9B76E8000-memory.dmp

          Filesize

          96KB

        • memory/4124-142-0x00007FF9B7070000-0x00007FF9B7087000-memory.dmp

          Filesize

          92KB

        • memory/4124-143-0x00007FF9AE870000-0x00007FF9AE881000-memory.dmp

          Filesize

          68KB

        • memory/4124-144-0x00007FF9AE850000-0x00007FF9AE867000-memory.dmp

          Filesize

          92KB

        • memory/4124-145-0x00007FF9A9230000-0x00007FF9A9241000-memory.dmp

          Filesize

          68KB

        • memory/4124-146-0x00007FF9A8B60000-0x00007FF9A8B7D000-memory.dmp

          Filesize

          116KB

        • memory/4124-147-0x00007FF9A7A80000-0x00007FF9A7A91000-memory.dmp

          Filesize

          68KB

        • memory/4124-148-0x00007FF9A6EF0000-0x00007FF9A70F0000-memory.dmp

          Filesize

          2.0MB

        • memory/4124-149-0x00007FF9A5E40000-0x00007FF9A6EEB000-memory.dmp

          Filesize

          16.7MB

        • memory/4124-150-0x00007FF9A7A40000-0x00007FF9A7A7F000-memory.dmp

          Filesize

          252KB

        • memory/4124-151-0x00007FF9A7A10000-0x00007FF9A7A31000-memory.dmp

          Filesize

          132KB

        • memory/4124-152-0x00007FF9A79F0000-0x00007FF9A7A08000-memory.dmp

          Filesize

          96KB

        • memory/4124-153-0x00007FF9A79D0000-0x00007FF9A79E1000-memory.dmp

          Filesize

          68KB

        • memory/4124-155-0x00007FF9A7990000-0x00007FF9A79A1000-memory.dmp

          Filesize

          68KB

        • memory/4124-154-0x00007FF9A79B0000-0x00007FF9A79C1000-memory.dmp

          Filesize

          68KB

        • memory/4124-156-0x00007FF9A7970000-0x00007FF9A798B000-memory.dmp

          Filesize

          108KB

        • memory/4124-157-0x00007FF9A7950000-0x00007FF9A7961000-memory.dmp

          Filesize

          68KB

        • memory/4124-158-0x00007FF9A5E20000-0x00007FF9A5E38000-memory.dmp

          Filesize

          96KB

        • memory/4124-159-0x00007FF9A5DF0000-0x00007FF9A5E20000-memory.dmp

          Filesize

          192KB

        • memory/4124-160-0x00007FF9A5D80000-0x00007FF9A5DE7000-memory.dmp

          Filesize

          412KB

        • memory/4124-161-0x00007FF9A5D10000-0x00007FF9A5D7F000-memory.dmp

          Filesize

          444KB

        • memory/4124-163-0x00007FF9A5C90000-0x00007FF9A5CEC000-memory.dmp

          Filesize

          368KB

        • memory/4124-162-0x00007FF9A5CF0000-0x00007FF9A5D01000-memory.dmp

          Filesize

          68KB

        • memory/4124-164-0x00007FF9A5B10000-0x00007FF9A5C88000-memory.dmp

          Filesize

          1.5MB

        • memory/4124-166-0x00007FF9B7830000-0x00007FF9B7840000-memory.dmp

          Filesize

          64KB

        • memory/4124-165-0x00007FF9A5AF0000-0x00007FF9A5B07000-memory.dmp

          Filesize

          92KB

        • memory/4124-167-0x00007FF9A5AC0000-0x00007FF9A5AEF000-memory.dmp

          Filesize

          188KB

        • memory/4124-168-0x00007FF9A5AA0000-0x00007FF9A5AB1000-memory.dmp

          Filesize

          68KB

        • memory/4124-169-0x00007FF9A5A80000-0x00007FF9A5A96000-memory.dmp

          Filesize

          88KB

        • memory/4124-170-0x00007FF9A59B0000-0x00007FF9A5A75000-memory.dmp

          Filesize

          788KB

        • memory/4124-171-0x00007FF9A5990000-0x00007FF9A59A5000-memory.dmp

          Filesize

          84KB

        • memory/4124-172-0x00007FF9A5420000-0x00007FF9A5431000-memory.dmp

          Filesize

          68KB

        • memory/4124-173-0x00007FF9A5400000-0x00007FF9A5412000-memory.dmp

          Filesize

          72KB

        • memory/4124-174-0x00007FF9A5280000-0x00007FF9A53FA000-memory.dmp

          Filesize

          1.5MB