Analysis
- max time kernel
43s - max time network
46s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
10/03/2024, 23:46
General
- Target Doki Doki Literature Club Plus.exe
- Size 635KB
- Sample240310-3r846aed73
- SHA256 b17b6a1e21e7beae66b256da045c02a5bf624e0c3ed3d7590167ee4d2f3cb7c5
Malware Config
Signatures
- Drops file in System32 directory 11 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of SetWindowsHookEx 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Doki Doki Literature Club Plus.exe"C:\Users\Admin\AppData\Local\Temp\Doki Doki Literature Club Plus.exe"1⤵
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\FindWait.png" /ForceBootstrapPaint3D1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc1⤵
- Drops file in System32 directory
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\StopWatch.xlsb"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/864-28-0x00007FFAF0110000-0x00007FFAF0120000-memory.dmp
memory/864-23-0x00007FFAF0110000-0x00007FFAF0120000-memory.dmp
memory/864-35-0x00007FFAED7B0000-0x00007FFAED7C0000-memory.dmp
memory/864-34-0x00007FFB30090000-0x00007FFB30285000-memory.dmp
memory/864-33-0x00007FFAED7B0000-0x00007FFAED7C0000-memory.dmp
memory/864-32-0x00007FFB30090000-0x00007FFB30285000-memory.dmp
memory/864-24-0x00007FFB30090000-0x00007FFB30285000-memory.dmp
memory/864-31-0x00007FFB30090000-0x00007FFB30285000-memory.dmp
memory/864-30-0x00007FFB30090000-0x00007FFB30285000-memory.dmp
memory/864-21-0x00007FFAF0110000-0x00007FFAF0120000-memory.dmp
memory/864-22-0x00007FFAF0110000-0x00007FFAF0120000-memory.dmp
memory/864-27-0x00007FFB30090000-0x00007FFB30285000-memory.dmp
memory/864-29-0x00007FFB30090000-0x00007FFB30285000-memory.dmp
memory/864-25-0x00007FFB30090000-0x00007FFB30285000-memory.dmp
memory/864-26-0x00007FFAF0110000-0x00007FFAF0120000-memory.dmp
memory/1008-17-0x000001D6CAB30000-0x000001D6CAB31000-memory.dmp
memory/1008-4-0x000001D6C1DC0000-0x000001D6C1DD0000-memory.dmp
memory/1008-19-0x000001D6CAB30000-0x000001D6CAB31000-memory.dmp
memory/1008-0-0x000001D6C1D80000-0x000001D6C1D90000-memory.dmp
memory/1008-18-0x000001D6CAB30000-0x000001D6CAB31000-memory.dmp
memory/1008-16-0x000001D6CAB30000-0x000001D6CAB31000-memory.dmp
memory/1008-15-0x000001D6CAA90000-0x000001D6CAA91000-memory.dmp
memory/1008-13-0x000001D6CAA90000-0x000001D6CAA91000-memory.dmp
memory/1008-11-0x000001D6CAA10000-0x000001D6CAA11000-memory.dmp