Resubmissions

11/08/2024, 12:15

240811-pfbgvstblg 7

Analysis

  • max time kernel
    59s
  • max time network
    69s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/01/2024, 08:18

General

  • Target

    SMM_WE/bgm_sm1clear.ogg

  • Size

    57KB

  • MD5

    56a3806deeccbeef50fa0d8275fcf3db

  • SHA1

    ba9310b890b61bde77111fd9df6f11aacd2d668d

  • SHA256

    fd9629866bc2ef812e4b32506b84b3dc542ae639efcd84cee44689aba3158515

  • SHA512

    3b7e79d370b1ab52b698d1434bbb0ce88fc209157ee84d81ce8807eae9a853422457ec14f8cbf258711869c8e5f570f70745ce95954baa27d603b54fb1f22a42

  • SSDEEP

    1536:VR2IJwqTt3f6lDrHkx4VaGW1ErXhFyAL9V3P:+IJNZSlDlrXfDL9V

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\SMM_WE\bgm_sm1clear.ogg
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3496
    • C:\Program Files\VideoLAN\VLC\vlc.exe
      "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\SMM_WE\bgm_sm1clear.ogg"
      2⤵
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2336
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x52c 0x524
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2064

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2336-5-0x00007FF6239E0000-0x00007FF623AD8000-memory.dmp

    Filesize

    992KB

  • memory/2336-6-0x00007FF8AF5C0000-0x00007FF8AF5F4000-memory.dmp

    Filesize

    208KB

  • memory/2336-20-0x00007FF8AEDC0000-0x00007FF8AEDD1000-memory.dmp

    Filesize

    68KB

  • memory/2336-15-0x00007FF89EA30000-0x00007FF89EC3B000-memory.dmp

    Filesize

    2.0MB

  • memory/2336-17-0x00007FF8AF150000-0x00007FF8AF171000-memory.dmp

    Filesize

    132KB

  • memory/2336-19-0x00007FF8AEDE0000-0x00007FF8AEDF1000-memory.dmp

    Filesize

    68KB

  • memory/2336-18-0x00007FF8AEF20000-0x00007FF8AEF38000-memory.dmp

    Filesize

    96KB

  • memory/2336-16-0x00007FF8AEF40000-0x00007FF8AEF81000-memory.dmp

    Filesize

    260KB

  • memory/2336-7-0x00007FF89EE30000-0x00007FF89F0E6000-memory.dmp

    Filesize

    2.7MB

  • memory/2336-14-0x00007FF8AF180000-0x00007FF8AF191000-memory.dmp

    Filesize

    68KB

  • memory/2336-13-0x00007FF8AF1A0000-0x00007FF8AF1BD000-memory.dmp

    Filesize

    116KB

  • memory/2336-12-0x00007FF8AF1C0000-0x00007FF8AF1D1000-memory.dmp

    Filesize

    68KB

  • memory/2336-11-0x00007FF8AF1E0000-0x00007FF8AF1F7000-memory.dmp

    Filesize

    92KB

  • memory/2336-10-0x00007FF8AF4A0000-0x00007FF8AF4B1000-memory.dmp

    Filesize

    68KB

  • memory/2336-9-0x00007FF8AF540000-0x00007FF8AF557000-memory.dmp

    Filesize

    92KB

  • memory/2336-8-0x00007FF8B4FE0000-0x00007FF8B4FF8000-memory.dmp

    Filesize

    96KB

  • memory/2336-22-0x00007FF8AE8D0000-0x00007FF8AE8E1000-memory.dmp

    Filesize

    68KB

  • memory/2336-21-0x00007FF89D980000-0x00007FF89EA30000-memory.dmp

    Filesize

    16.7MB

  • memory/2336-57-0x00007FF89D980000-0x00007FF89EA30000-memory.dmp

    Filesize

    16.7MB