4a08a6514a9bb199cae62c8a6ad799f064c3ed0c933c01eeafa59023b24aa56d

Resubmissions

11/08/2024, 12:15

240811-pfbgvstblg 7

Analysis

max time kernel
51s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 08:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SMM_WE/snd_1up.ogg
Size

7KB
MD5

66babf354adb6a36b6152c0020c74403
SHA1

4a2c6a19a4380dd5fff4623317916efe524bec9a
SHA256

b9fe739a81c67553694ebe097d2471136258f710c2ab65d98e3c86cc1657720c
SHA512

16857a868a420d2ebf93b618f3daf0e3bf5e3bcbec34dc585f1f8f6bedca3569a72e117142073439293872b76c14cacdee84e15f37e56663f2238578b28f313a
SSDEEP

192:/DJomrimXOct5g6kF2D6PN4S9n0yJFE1N41KtVolrNWCu21E+iey:bimzp26U140nxFEfecKZWCu9ey

Score

1^/10

Malware Config

Signatures

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1976	vlc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1976	vlc.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: 33	2724	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2724	AUDIODG.EXE
Token: 33	2724	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2724	AUDIODG.EXE
Token: 33	1976	vlc.exe
Token: SeIncBasePriorityPrivilege	1976	vlc.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
1976	vlc.exe
1976	vlc.exe
1976	vlc.exe
1976	vlc.exe
1976	vlc.exe
1976	vlc.exe
1976	vlc.exe
1976	vlc.exe
1976	vlc.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
1976	vlc.exe
1976	vlc.exe
1976	vlc.exe
1976	vlc.exe
1976	vlc.exe
1976	vlc.exe
1976	vlc.exe
1976	vlc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1976	vlc.exe

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\SMM_WE\snd_1up.ogg"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1976

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1976-6-0x000007FEFB1F0000-0x000007FEFB224000-memory.dmp

Filesize
208KB

Download
memory/1976-5-0x000000013FB60000-0x000000013FC58000-memory.dmp

Filesize
992KB

Download
memory/1976-8-0x000007FEFBBD0000-0x000007FEFBBE8000-memory.dmp

Filesize
96KB

Download
memory/1976-13-0x000007FEFAEC0000-0x000007FEFAEDD000-memory.dmp

Filesize
116KB

Download
memory/1976-14-0x000007FEFAEA0000-0x000007FEFAEB1000-memory.dmp

Filesize
68KB

Download
memory/1976-12-0x000007FEFAEE0000-0x000007FEFAEF1000-memory.dmp

Filesize
68KB

Download
memory/1976-11-0x000007FEFB0C0000-0x000007FEFB0D7000-memory.dmp

Filesize
92KB

Download
memory/1976-10-0x000007FEFB0E0000-0x000007FEFB0F1000-memory.dmp

Filesize
68KB

Download
memory/1976-9-0x000007FEFB1D0000-0x000007FEFB1E7000-memory.dmp

Filesize
92KB

Download
memory/1976-7-0x000007FEF7730000-0x000007FEF79E6000-memory.dmp

Filesize
2.7MB

Download
memory/1976-29-0x000007FEF5720000-0x000007FEF5731000-memory.dmp

Filesize
68KB

Download
memory/1976-30-0x000007FEF56C0000-0x000007FEF571C000-memory.dmp

Filesize
368KB

Download
memory/1976-28-0x000007FEF5740000-0x000007FEF57BC000-memory.dmp

Filesize
496KB

Download
memory/1976-27-0x000007FEF57C0000-0x000007FEF5827000-memory.dmp

Filesize
412KB

Download
memory/1976-26-0x000007FEF6B80000-0x000007FEF6BB0000-memory.dmp

Filesize
192KB

Download
memory/1976-25-0x000007FEF6BB0000-0x000007FEF6BC8000-memory.dmp

Filesize
96KB

Download
memory/1976-24-0x000007FEF6BD0000-0x000007FEF6BE1000-memory.dmp

Filesize
68KB

Download
memory/1976-23-0x000007FEF6BF0000-0x000007FEF6C0B000-memory.dmp

Filesize
108KB

Download
memory/1976-22-0x000007FEF7710000-0x000007FEF7721000-memory.dmp

Filesize
68KB

Download
memory/1976-21-0x000007FEF7A80000-0x000007FEF7A91000-memory.dmp

Filesize
68KB

Download
memory/1976-20-0x000007FEFAA80000-0x000007FEFAA91000-memory.dmp

Filesize
68KB

Download
memory/1976-18-0x000007FEFADE0000-0x000007FEFAE01000-memory.dmp

Filesize
132KB

Download
memory/1976-15-0x000007FEF5A40000-0x000007FEF6AF0000-memory.dmp

Filesize
16.7MB

Download
memory/1976-19-0x000007FEFAAA0000-0x000007FEFAAB8000-memory.dmp

Filesize
96KB

Download
memory/1976-17-0x000007FEFAAC0000-0x000007FEFAB01000-memory.dmp

Filesize
260KB

Download
memory/1976-16-0x000007FEF5830000-0x000007FEF5A3B000-memory.dmp

Filesize
2.0MB

Download
memory/1976-32-0x000007FEF5520000-0x000007FEF5537000-memory.dmp

Filesize
92KB

Download
memory/1976-33-0x000007FEFB1C0000-0x000007FEFB1D0000-memory.dmp

Filesize
64KB

Download
memory/1976-31-0x000007FEF5540000-0x000007FEF56C0000-memory.dmp

Filesize
1.5MB

Download
memory/1976-34-0x000007FEF54F0000-0x000007FEF551F000-memory.dmp

Filesize
188KB

Download
memory/1976-36-0x000007FEF54B0000-0x000007FEF54C6000-memory.dmp

Filesize
88KB

Download
memory/1976-35-0x000007FEF54D0000-0x000007FEF54E1000-memory.dmp

Filesize
68KB

Download
memory/1976-37-0x000007FEF53E0000-0x000007FEF54A5000-memory.dmp

Filesize
788KB

Download
memory/1976-38-0x000007FEF5080000-0x000007FEF5091000-memory.dmp

Filesize
68KB

Download
memory/1976-39-0x000007FEF5060000-0x000007FEF5072000-memory.dmp

Filesize
72KB

Download
memory/1976-40-0x000007FEF4EE0000-0x000007FEF505A000-memory.dmp

Filesize
1.5MB

Download
memory/1976-41-0x000007FEF4EC0000-0x000007FEF4ED3000-memory.dmp

Filesize
76KB

Download
memory/1976-42-0x000007FEF4EA0000-0x000007FEF4EB4000-memory.dmp

Filesize
80KB

Download
memory/1976-43-0x000007FEF4E80000-0x000007FEF4E91000-memory.dmp

Filesize
68KB

Download
memory/1976-44-0x000007FEF4E60000-0x000007FEF4E71000-memory.dmp

Filesize
68KB

Download
memory/1976-45-0x000007FEF4E40000-0x000007FEF4E51000-memory.dmp

Filesize
68KB

Download