Resubmissions

11/08/2024, 12:15

240811-pfbgvstblg 7

Analysis

  • max time kernel
    50s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    28/01/2024, 08:18

General

  • Target

    SMM_WE/bgm_smwclear.ogg

  • Size

    91KB

  • MD5

    5bef7ed5a5ab7d2069b16164ca18ff47

  • SHA1

    e98a384121e72e0d45dd947131a9e01d74eb601e

  • SHA256

    5e27eb04afe7163fd4c957b116d199667c1360790085e4c92a8d637aedb0d233

  • SHA512

    3d0e5337a208b73ab1a77f4a857ffbe0f0c99ad39365cbe1cad6e6ac205c2eec976b0e0ed8301d1f8a132f17d50d3c5d6bf460a0f9aec1d3181de1be551c9fa1

  • SSDEEP

    1536:zRA57VfUAjkJuxKKk0jVPKeoy64tSOhr+u1VZwcKl1DbZ1xiDqrtOrHwWT9faMPI:exxjkcxKkJoVKr+u1VZwXPvZviehCQWg

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\SMM_WE\bgm_smwclear.ogg"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:2508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2508-6-0x000007FEF6CA0000-0x000007FEF6CD4000-memory.dmp

    Filesize

    208KB

  • memory/2508-5-0x000000013FA10000-0x000000013FB08000-memory.dmp

    Filesize

    992KB

  • memory/2508-8-0x000007FEFBCD0000-0x000007FEFBCE8000-memory.dmp

    Filesize

    96KB

  • memory/2508-12-0x000007FEF6B30000-0x000007FEF6B41000-memory.dmp

    Filesize

    68KB

  • memory/2508-11-0x000007FEF6B50000-0x000007FEF6B67000-memory.dmp

    Filesize

    92KB

  • memory/2508-10-0x000007FEF71A0000-0x000007FEF71B1000-memory.dmp

    Filesize

    68KB

  • memory/2508-9-0x000007FEFB1D0000-0x000007FEFB1E7000-memory.dmp

    Filesize

    92KB

  • memory/2508-14-0x000007FEF66C0000-0x000007FEF66D1000-memory.dmp

    Filesize

    68KB

  • memory/2508-13-0x000007FEF6720000-0x000007FEF673D000-memory.dmp

    Filesize

    116KB

  • memory/2508-7-0x000007FEF5FB0000-0x000007FEF6266000-memory.dmp

    Filesize

    2.7MB

  • memory/2508-15-0x000007FEF5DA0000-0x000007FEF5FAB000-memory.dmp

    Filesize

    2.0MB

  • memory/2508-18-0x000007FEF6690000-0x000007FEF66B1000-memory.dmp

    Filesize

    132KB

  • memory/2508-21-0x000007FEF6450000-0x000007FEF6461000-memory.dmp

    Filesize

    68KB

  • memory/2508-20-0x000007FEF6470000-0x000007FEF6481000-memory.dmp

    Filesize

    68KB

  • memory/2508-25-0x000007FEF63D0000-0x000007FEF63E8000-memory.dmp

    Filesize

    96KB

  • memory/2508-24-0x000007FEF63F0000-0x000007FEF6401000-memory.dmp

    Filesize

    68KB

  • memory/2508-23-0x000007FEF6410000-0x000007FEF642B000-memory.dmp

    Filesize

    108KB

  • memory/2508-22-0x000007FEF6430000-0x000007FEF6441000-memory.dmp

    Filesize

    68KB

  • memory/2508-26-0x000007FEF63A0000-0x000007FEF63D0000-memory.dmp

    Filesize

    192KB

  • memory/2508-17-0x000007FEF6520000-0x000007FEF6561000-memory.dmp

    Filesize

    260KB

  • memory/2508-27-0x000007FEF4C80000-0x000007FEF4CE7000-memory.dmp

    Filesize

    412KB

  • memory/2508-19-0x000007FEF6500000-0x000007FEF6518000-memory.dmp

    Filesize

    96KB

  • memory/2508-29-0x000007FEF6380000-0x000007FEF6391000-memory.dmp

    Filesize

    68KB

  • memory/2508-30-0x000007FEF4BA0000-0x000007FEF4BFC000-memory.dmp

    Filesize

    368KB

  • memory/2508-28-0x000007FEF4C00000-0x000007FEF4C7C000-memory.dmp

    Filesize

    496KB

  • memory/2508-32-0x000007FEF4A00000-0x000007FEF4A17000-memory.dmp

    Filesize

    92KB

  • memory/2508-31-0x000007FEF4A20000-0x000007FEF4BA0000-memory.dmp

    Filesize

    1.5MB

  • memory/2508-36-0x000007FEF4990000-0x000007FEF49A6000-memory.dmp

    Filesize

    88KB

  • memory/2508-16-0x000007FEF4CF0000-0x000007FEF5DA0000-memory.dmp

    Filesize

    16.7MB

  • memory/2508-35-0x000007FEF49B0000-0x000007FEF49C1000-memory.dmp

    Filesize

    68KB

  • memory/2508-34-0x000007FEF49D0000-0x000007FEF49FF000-memory.dmp

    Filesize

    188KB

  • memory/2508-33-0x000007FEF6B20000-0x000007FEF6B30000-memory.dmp

    Filesize

    64KB

  • memory/2508-37-0x000007FEF48C0000-0x000007FEF4985000-memory.dmp

    Filesize

    788KB

  • memory/2508-38-0x000007FEF48A0000-0x000007FEF48B5000-memory.dmp

    Filesize

    84KB

  • memory/2508-39-0x000007FEF4860000-0x000007FEF4871000-memory.dmp

    Filesize

    68KB

  • memory/2508-40-0x000007FEF4840000-0x000007FEF4852000-memory.dmp

    Filesize

    72KB

  • memory/2508-43-0x000007FEF4680000-0x000007FEF4694000-memory.dmp

    Filesize

    80KB

  • memory/2508-42-0x000007FEF46A0000-0x000007FEF46B3000-memory.dmp

    Filesize

    76KB

  • memory/2508-44-0x000007FEF4660000-0x000007FEF4671000-memory.dmp

    Filesize

    68KB

  • memory/2508-45-0x000007FEF4640000-0x000007FEF4651000-memory.dmp

    Filesize

    68KB

  • memory/2508-46-0x000007FEF4620000-0x000007FEF4631000-memory.dmp

    Filesize

    68KB

  • memory/2508-41-0x000007FEF46C0000-0x000007FEF483A000-memory.dmp

    Filesize

    1.5MB