Analysis

  • max time kernel
    146s
  • max time network
    163s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/03/2024, 22:39

General

  • Target

    Cat.Goes.Fishing.v13.11.2019/music_EasyLemon.ogg

  • Size

    1022KB

  • MD5

    34424ebb6a54fedb133782d9ed7e5e87

  • SHA1

    f8a285ce0b8ae267751a335c1a56887e59f53cfa

  • SHA256

    22358861581e2c7616b96aef602ce3b1553c1b4ad68ce330a27aad6576f74211

  • SHA512

    4cc739277ef537431913e312594a94dabfcd7d04544f891ed378222dbce12e73a1c1c0eb5da8e57f12f1d86b5e563371d31bbe1539653558ecb861b6895456e8

  • SSDEEP

    24576:XErSZsqLxHcbaYQ8RIyFKUK5lwypgZCIHRg0d:kSZs88OSRm3vuCIG2

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Cat.Goes.Fishing.v13.11.2019\music_EasyLemon.ogg
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2112
    • C:\Program Files\VideoLAN\VLC\vlc.exe
      "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Cat.Goes.Fishing.v13.11.2019\music_EasyLemon.ogg"
      2⤵
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:4600
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x33c 0x4f4
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2760

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/4600-5-0x00007FF773C30000-0x00007FF773D28000-memory.dmp

          Filesize

          992KB

        • memory/4600-6-0x00007FF8FB080000-0x00007FF8FB0B4000-memory.dmp

          Filesize

          208KB

        • memory/4600-7-0x00007FF8E6900000-0x00007FF8E6BB4000-memory.dmp

          Filesize

          2.7MB

        • memory/4600-8-0x00007FF8FC600000-0x00007FF8FC618000-memory.dmp

          Filesize

          96KB

        • memory/4600-9-0x00007FF8FB0D0000-0x00007FF8FB0E7000-memory.dmp

          Filesize

          92KB

        • memory/4600-11-0x00007FF8F71B0000-0x00007FF8F71C7000-memory.dmp

          Filesize

          92KB

        • memory/4600-10-0x00007FF8F72A0000-0x00007FF8F72B1000-memory.dmp

          Filesize

          68KB

        • memory/4600-12-0x00007FF8F7190000-0x00007FF8F71A1000-memory.dmp

          Filesize

          68KB

        • memory/4600-14-0x00007FF8F7150000-0x00007FF8F7161000-memory.dmp

          Filesize

          68KB

        • memory/4600-13-0x00007FF8F7170000-0x00007FF8F718D000-memory.dmp

          Filesize

          116KB

        • memory/4600-15-0x00007FF8E7240000-0x00007FF8E7440000-memory.dmp

          Filesize

          2.0MB

        • memory/4600-16-0x00007FF8F7110000-0x00007FF8F714F000-memory.dmp

          Filesize

          252KB

        • memory/4600-17-0x00007FF8E5850000-0x00007FF8E68FB000-memory.dmp

          Filesize

          16.7MB

        • memory/4600-28-0x00007FF8F6540000-0x00007FF8F65AF000-memory.dmp

          Filesize

          444KB

        • memory/4600-26-0x00007FF8F6F30000-0x00007FF8F6F60000-memory.dmp

          Filesize

          192KB

        • memory/4600-29-0x00007FF8F6520000-0x00007FF8F6531000-memory.dmp

          Filesize

          68KB

        • memory/4600-30-0x00007FF8F64C0000-0x00007FF8F651C000-memory.dmp

          Filesize

          368KB

        • memory/4600-27-0x00007FF8F65B0000-0x00007FF8F6617000-memory.dmp

          Filesize

          412KB

        • memory/4600-25-0x00007FF8F6F60000-0x00007FF8F6F78000-memory.dmp

          Filesize

          96KB

        • memory/4600-31-0x00007FF8E70C0000-0x00007FF8E7238000-memory.dmp

          Filesize

          1.5MB

        • memory/4600-24-0x00007FF8F6F80000-0x00007FF8F6F91000-memory.dmp

          Filesize

          68KB

        • memory/4600-33-0x00007FF8F6400000-0x00007FF8F6410000-memory.dmp

          Filesize

          64KB

        • memory/4600-32-0x00007FF8F6430000-0x00007FF8F6447000-memory.dmp

          Filesize

          92KB

        • memory/4600-37-0x00007FF8E77F0000-0x00007FF8E78B5000-memory.dmp

          Filesize

          788KB

        • memory/4600-36-0x00007FF8E7FE0000-0x00007FF8E7FF6000-memory.dmp

          Filesize

          88KB

        • memory/4600-39-0x00007FF8E77B0000-0x00007FF8E77C1000-memory.dmp

          Filesize

          68KB

        • memory/4600-40-0x00007FF8E76E0000-0x00007FF8E76F2000-memory.dmp

          Filesize

          72KB

        • memory/4600-38-0x00007FF8E77D0000-0x00007FF8E77E5000-memory.dmp

          Filesize

          84KB

        • memory/4600-35-0x00007FF8F63E0000-0x00007FF8F63F1000-memory.dmp

          Filesize

          68KB

        • memory/4600-41-0x00007FF8E4C50000-0x00007FF8E4DCA000-memory.dmp

          Filesize

          1.5MB

        • memory/4600-42-0x00007FF8E70A0000-0x00007FF8E70B3000-memory.dmp

          Filesize

          76KB

        • memory/4600-43-0x00007FF8E7080000-0x00007FF8E7094000-memory.dmp

          Filesize

          80KB

        • memory/4600-44-0x00007FF8E7060000-0x00007FF8E7071000-memory.dmp

          Filesize

          68KB

        • memory/4600-45-0x00007FF8E7040000-0x00007FF8E7051000-memory.dmp

          Filesize

          68KB

        • memory/4600-46-0x00007FF8E7020000-0x00007FF8E7031000-memory.dmp

          Filesize

          68KB

        • memory/4600-34-0x00007FF8ED500000-0x00007FF8ED52F000-memory.dmp

          Filesize

          188KB

        • memory/4600-23-0x00007FF8F6FA0000-0x00007FF8F6FBB000-memory.dmp

          Filesize

          108KB

        • memory/4600-22-0x00007FF8F7060000-0x00007FF8F7071000-memory.dmp

          Filesize

          68KB

        • memory/4600-21-0x00007FF8F7080000-0x00007FF8F7091000-memory.dmp

          Filesize

          68KB

        • memory/4600-20-0x00007FF8F70A0000-0x00007FF8F70B1000-memory.dmp

          Filesize

          68KB

        • memory/4600-19-0x00007FF8F70C0000-0x00007FF8F70D8000-memory.dmp

          Filesize

          96KB

        • memory/4600-18-0x00007FF8F70E0000-0x00007FF8F7101000-memory.dmp

          Filesize

          132KB

        • memory/4600-59-0x00007FF8E5850000-0x00007FF8E68FB000-memory.dmp

          Filesize

          16.7MB