Overview
overview
7Static
static
3SMM_WE.7z
windows7-x64
3SMM_WE.7z
windows10-2004-x64
3SMM_WE/bgm...ar.ogg
windows7-x64
1SMM_WE/bgm...ar.ogg
windows10-2004-x64
7SMM_WE/bgm...ar.ogg
windows7-x64
1SMM_WE/bgm...ar.ogg
windows10-2004-x64
7SMM_WE/bgm...le.ogg
windows7-x64
1SMM_WE/bgm...le.ogg
windows10-2004-x64
7SMM_WE/data.win
windows7-x64
3SMM_WE/data.win
windows10-2004-x64
3SMM_WE/font_as.ttf
windows7-x64
3SMM_WE/font_as.ttf
windows10-2004-x64
7SMM_WE/fontcjk.ttf
windows7-x64
3SMM_WE/fontcjk.ttf
windows10-2004-x64
7SMM_WE/options.ini
windows7-x64
1SMM_WE/options.ini
windows10-2004-x64
1SMM_WE/snd_1up.ogg
windows7-x64
1SMM_WE/snd_1up.ogg
windows10-2004-x64
7SMM_WE/snd_DSM_1.ogg
windows7-x64
1SMM_WE/snd_DSM_1.ogg
windows10-2004-x64
7SMM_WE/snd_DSM_2.ogg
windows7-x64
1SMM_WE/snd_DSM_2.ogg
windows10-2004-x64
7SMM_WE/snd_DSM_3.ogg
windows7-x64
1SMM_WE/snd_DSM_3.ogg
windows10-2004-x64
7SMM_WE/snd_DSM_4.ogg
windows7-x64
1SMM_WE/snd_DSM_4.ogg
windows10-2004-x64
7SMM_WE/snd...ns.ogg
windows7-x64
1SMM_WE/snd...ns.ogg
windows10-2004-x64
7SMM_WE/snd...al.ogg
windows7-x64
1SMM_WE/snd...al.ogg
windows10-2004-x64
7SMM_WE/snd...in.ogg
windows7-x64
1SMM_WE/snd...in.ogg
windows10-2004-x64
7Resubmissions
11/08/2024, 12:15
240811-pfbgvstblg 7Analysis
-
max time kernel
59s -
max time network
76s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
28/01/2024, 08:18
Static task
static1
Behavioral task
behavioral1
Sample
SMM_WE.7z
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
SMM_WE.7z
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
SMM_WE/bgm_sm1clear.ogg
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
SMM_WE/bgm_sm1clear.ogg
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
SMM_WE/bgm_smwclear.ogg
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
SMM_WE/bgm_smwclear.ogg
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
SMM_WE/bgm_smwclear_castle.ogg
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
SMM_WE/bgm_smwclear_castle.ogg
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
SMM_WE/data.win
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
SMM_WE/data.win
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
SMM_WE/font_as.ttf
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
SMM_WE/font_as.ttf
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
SMM_WE/fontcjk.ttf
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
SMM_WE/fontcjk.ttf
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
SMM_WE/options.ini
Resource
win7-20240729-en
Behavioral task
behavioral16
Sample
SMM_WE/options.ini
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
SMM_WE/snd_1up.ogg
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
SMM_WE/snd_1up.ogg
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
SMM_WE/snd_DSM_1.ogg
Resource
win7-20240705-en
Behavioral task
behavioral20
Sample
SMM_WE/snd_DSM_1.ogg
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
SMM_WE/snd_DSM_2.ogg
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
SMM_WE/snd_DSM_2.ogg
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
SMM_WE/snd_DSM_3.ogg
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
SMM_WE/snd_DSM_3.ogg
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
SMM_WE/snd_DSM_4.ogg
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
SMM_WE/snd_DSM_4.ogg
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
SMM_WE/snd_NSMBU_1up_coins.ogg
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
SMM_WE/snd_NSMBU_1up_coins.ogg
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
SMM_WE/snd_NSMBU_1up_original.ogg
Resource
win7-20240705-en
Behavioral task
behavioral30
Sample
SMM_WE/snd_NSMBU_1up_original.ogg
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
SMM_WE/snd_NSMBU_airspin.ogg
Resource
win7-20240729-en
Behavioral task
behavioral32
Sample
SMM_WE/snd_NSMBU_airspin.ogg
Resource
win10v2004-20240802-en
General
-
Target
SMM_WE/bgm_smwclear_castle.ogg
-
Size
90KB
-
MD5
dcd4aa666c321cfbf6bd674e0af7079d
-
SHA1
f2542178d03b16ecbb834a7c40db69f0b136097a
-
SHA256
220449588651b37f2b5f844a6db2f538f815434ecce3b3dfdcb7e074b5ef004a
-
SHA512
7aae4a9ba9af4b1f4f41bc266ccc25590d196bd102fbce97f2eb12eb41e27022da3fd40bb402d6ad69a620c5a048ba23cfc029977aad43ae26545b826c54fbbb
-
SSDEEP
1536:GRoL86BHd69n+aMFE2B9Uat8daA1EQ+JTY4grXzuXEcjCYfl+rUEw9vqJnHno:7YMdg+aMFEwUat8db1H++z0ErYN+gEwR
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings cmd.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2756 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2756 vlc.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 3040 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 3040 AUDIODG.EXE Token: 33 2756 vlc.exe Token: SeIncBasePriorityPrivilege 2756 vlc.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 2756 vlc.exe 2756 vlc.exe 2756 vlc.exe 2756 vlc.exe 2756 vlc.exe 2756 vlc.exe 2756 vlc.exe 2756 vlc.exe -
Suspicious use of SendNotifyMessage 7 IoCs
pid Process 2756 vlc.exe 2756 vlc.exe 2756 vlc.exe 2756 vlc.exe 2756 vlc.exe 2756 vlc.exe 2756 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2756 vlc.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1236 wrote to memory of 2756 1236 cmd.exe 96 PID 1236 wrote to memory of 2756 1236 cmd.exe 96
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\SMM_WE\bgm_smwclear_castle.ogg1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\SMM_WE\bgm_smwclear_castle.ogg"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2756
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4cc 0x4781⤵
- Suspicious use of AdjustPrivilegeToken
PID:3040