Resubmissions

11/08/2024, 12:15

240811-pfbgvstblg 7

Analysis

  • max time kernel
    59s
  • max time network
    76s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/01/2024, 08:18

General

  • Target

    SMM_WE/bgm_smwclear_castle.ogg

  • Size

    90KB

  • MD5

    dcd4aa666c321cfbf6bd674e0af7079d

  • SHA1

    f2542178d03b16ecbb834a7c40db69f0b136097a

  • SHA256

    220449588651b37f2b5f844a6db2f538f815434ecce3b3dfdcb7e074b5ef004a

  • SHA512

    7aae4a9ba9af4b1f4f41bc266ccc25590d196bd102fbce97f2eb12eb41e27022da3fd40bb402d6ad69a620c5a048ba23cfc029977aad43ae26545b826c54fbbb

  • SSDEEP

    1536:GRoL86BHd69n+aMFE2B9Uat8daA1EQ+JTY4grXzuXEcjCYfl+rUEw9vqJnHno:7YMdg+aMFEwUat8db1H++z0ErYN+gEwR

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\SMM_WE\bgm_smwclear_castle.ogg
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1236
    • C:\Program Files\VideoLAN\VLC\vlc.exe
      "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\SMM_WE\bgm_smwclear_castle.ogg"
      2⤵
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2756
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x4cc 0x478
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3040

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2756-5-0x00007FF6BC5B0000-0x00007FF6BC6A8000-memory.dmp

    Filesize

    992KB

  • memory/2756-6-0x00007FFBBD3C0000-0x00007FFBBD3F4000-memory.dmp

    Filesize

    208KB

  • memory/2756-7-0x00007FFBBC200000-0x00007FFBBC4B6000-memory.dmp

    Filesize

    2.7MB

  • memory/2756-14-0x00007FFBBBF00000-0x00007FFBBBF11000-memory.dmp

    Filesize

    68KB

  • memory/2756-16-0x00007FFBBBCA0000-0x00007FFBBBCE1000-memory.dmp

    Filesize

    260KB

  • memory/2756-13-0x00007FFBBBF20000-0x00007FFBBBF3D000-memory.dmp

    Filesize

    116KB

  • memory/2756-15-0x00007FFBBBCF0000-0x00007FFBBBEFB000-memory.dmp

    Filesize

    2.0MB

  • memory/2756-12-0x00007FFBBBF40000-0x00007FFBBBF51000-memory.dmp

    Filesize

    68KB

  • memory/2756-11-0x00007FFBBC1C0000-0x00007FFBBC1D7000-memory.dmp

    Filesize

    92KB

  • memory/2756-10-0x00007FFBBC1E0000-0x00007FFBBC1F1000-memory.dmp

    Filesize

    68KB

  • memory/2756-9-0x00007FFBCBB10000-0x00007FFBCBB27000-memory.dmp

    Filesize

    92KB

  • memory/2756-8-0x00007FFBCC7F0000-0x00007FFBCC808000-memory.dmp

    Filesize

    96KB

  • memory/2756-22-0x00007FFBBAB40000-0x00007FFBBAB51000-memory.dmp

    Filesize

    68KB

  • memory/2756-21-0x00007FFBBAB60000-0x00007FFBBAB71000-memory.dmp

    Filesize

    68KB

  • memory/2756-20-0x00007FFBBAB80000-0x00007FFBBAB91000-memory.dmp

    Filesize

    68KB

  • memory/2756-19-0x00007FFBBABA0000-0x00007FFBBABB8000-memory.dmp

    Filesize

    96KB

  • memory/2756-18-0x00007FFBBABC0000-0x00007FFBBABE1000-memory.dmp

    Filesize

    132KB

  • memory/2756-17-0x00007FFBBABF0000-0x00007FFBBBCA0000-memory.dmp

    Filesize

    16.7MB

  • memory/2756-53-0x00007FFBBABF0000-0x00007FFBBBCA0000-memory.dmp

    Filesize

    16.7MB