Resubmissions
03-05-2024 20:09
240503-yxg6eahb68 1026-03-2024 12:19
240326-phb66sch41 311-03-2024 19:53
240311-yl4v2acf8z 1002-03-2024 12:09
240302-pbjyfadb7y 1012-10-2023 13:44
231012-q1ynkaee78 10Analysis
-
max time kernel
152s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
26-03-2024 12:19
General
-
Target
dl2.exe
-
Size
849KB
-
MD5
c2055b7fbaa041d9f68b9d5df9b45edd
-
SHA1
e4bd443bd4ce9029290dcd4bb47cb1a01f3b1b06
-
SHA256
342f04c4720590c40d24078d46d9b19d8175565f0af460598171d58f5ffc48f3
-
SHA512
18905b75938b8af9468b1aa3ffbae796a139c2762e623aa6ffb9ec2b293dd04aa1f90d1ed5a7dbda7853795a3688e368121a134c7f63e527a8e5e7679301a1dc
-
SSDEEP
12288:A3RY3yNqMRTF4q2rxHn2ot/81xpNQyjUXlmoe7ufjHAtjXD7r2:A3RY3R24q+xn/8Xp2yOl5fzQ/2
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 54 IoCs
-
Suspicious use of SendNotifyMessage 53 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dl2.exe"C:\Users\Admin\AppData\Local\Temp\dl2.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\dl2.exeC:\Users\Admin\AppData\Local\Temp\dl2.exe {CFCF1128-405F-4030-8790-D152862DD8BD}1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\CheckpointDisable.3gp"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\CheckpointDisable.3gp"1⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\CheckpointDisable.3gp"1⤵
-
C:\Windows\system32\msinfo32.exe"C:\Windows\system32\msinfo32.exe" "C:\Users\Admin\Desktop\SuspendUnpublish.nfo"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\vlc\vlcrcFilesize
93KB
MD5478a4a09f4f74e97335cd4d5e9da7ab5
SHA13c4f1dc52a293f079095d0b0370428ec8e8f9315
SHA256884b59950669842f3c45e6da3480cd9a553538b951fb155b435b48ff38683974
SHA512e96719663cd264132a8e1ea8c3f8a148c778a0c68caa2468ba47629393605b197dd9e00efad91f389de9fcc77b04981a0cf87f785f3c645cdc9e4ebd98060ca1
-
memory/560-47-0x000007FEF6620000-0x000007FEF6637000-memory.dmpFilesize
92KB
-
memory/560-43-0x000007FEF6690000-0x000007FEF66A8000-memory.dmpFilesize
96KB
-
memory/560-49-0x000007FEF6180000-0x000007FEF6191000-memory.dmpFilesize
68KB
-
memory/560-29-0x000007FEF5200000-0x000007FEF54B4000-memory.dmpFilesize
2.7MB
-
memory/560-28-0x000007FEF54C0000-0x000007FEF54F4000-memory.dmpFilesize
208KB
-
memory/560-27-0x000000013F4E0000-0x000000013F5D8000-memory.dmpFilesize
992KB
-
memory/628-55-0x000007FEF5000000-0x000007FEF5011000-memory.dmpFilesize
68KB
-
memory/628-66-0x000000013F4E0000-0x000000013F5D8000-memory.dmpFilesize
992KB
-
memory/628-23-0x000000013F4E0000-0x000000013F5D8000-memory.dmpFilesize
992KB
-
memory/628-54-0x000007FEF5020000-0x000007FEF503D000-memory.dmpFilesize
116KB
-
memory/628-50-0x000007FEF6620000-0x000007FEF6637000-memory.dmpFilesize
92KB
-
memory/628-53-0x000007FEF5AB0000-0x000007FEF5AC1000-memory.dmpFilesize
68KB
-
memory/628-52-0x000007FEF60A0000-0x000007FEF60B7000-memory.dmpFilesize
92KB
-
memory/628-24-0x000007FEF54C0000-0x000007FEF54F4000-memory.dmpFilesize
208KB
-
memory/628-25-0x000007FEF5200000-0x000007FEF54B4000-memory.dmpFilesize
2.7MB
-
memory/628-51-0x000007FEF6180000-0x000007FEF6191000-memory.dmpFilesize
68KB
-
memory/628-57-0x000007FEF4E00000-0x000007FEF5000000-memory.dmpFilesize
2.0MB
-
memory/628-69-0x000007FEF5200000-0x000007FEF54B4000-memory.dmpFilesize
2.7MB
-
memory/628-46-0x000007FEF6690000-0x000007FEF66A8000-memory.dmpFilesize
96KB
-
memory/628-67-0x000007FEF54C0000-0x000007FEF54F4000-memory.dmpFilesize
208KB
-
memory/1752-42-0x000007FEF5200000-0x000007FEF54B4000-memory.dmpFilesize
2.7MB
-
memory/1752-45-0x000007FEF6620000-0x000007FEF6637000-memory.dmpFilesize
92KB
-
memory/1752-44-0x000007FEF6690000-0x000007FEF66A8000-memory.dmpFilesize
96KB
-
memory/1752-48-0x000007FEF6180000-0x000007FEF6191000-memory.dmpFilesize
68KB
-
memory/1752-36-0x000000013F4E0000-0x000000013F5D8000-memory.dmpFilesize
992KB
-
memory/1752-37-0x000007FEF54C0000-0x000007FEF54F4000-memory.dmpFilesize
208KB
-
memory/2780-12-0x00000000002C0000-0x00000000003C0000-memory.dmpFilesize
1024KB
-
memory/2780-10-0x0000000000240000-0x0000000000270000-memory.dmpFilesize
192KB
-
memory/2888-20-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/2888-19-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/3052-2-0x00000000006A0000-0x00000000007A0000-memory.dmpFilesize
1024KB
-
memory/3052-18-0x00000000006A0000-0x00000000007A0000-memory.dmpFilesize
1024KB
-
memory/3052-1-0x0000000000670000-0x00000000006A0000-memory.dmpFilesize
192KB