Analysis
- max time kernel
592s - max time network
492s - platform
windows11-21h2_x64 - resource
win11-20240221-en - resource tags
- submitted
02/04/2024, 12:29
General
- Target KinitoPET-Python-Virtual-Assistant-main/GameAssets/Surf.mp3
- Size 16KB
- Sample240402-ppdnkshg9s
- SHA256 0b1306e5992aa0a87f4a76ac46fb7bfa60a8025071204385875bba5536752c7a
Malware Config
Signatures
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 8 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\KinitoPET-Python-Virtual-Assistant-main\GameAssets\Surf.mp3"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004BC 0x00000000000004C81⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4072-5-0x00007FF7A7A40000-0x00007FF7A7B38000-memory.dmp
memory/4072-6-0x00007FFA139B0000-0x00007FFA139E4000-memory.dmp
memory/4072-7-0x00007FFA01F40000-0x00007FFA021F4000-memory.dmp
memory/4072-8-0x00007FFA18C60000-0x00007FFA18C78000-memory.dmp
memory/4072-9-0x00007FFA16850000-0x00007FFA16867000-memory.dmp
memory/4072-10-0x00007FFA13C50000-0x00007FFA13C61000-memory.dmp
memory/4072-11-0x00007FFA13910000-0x00007FFA13927000-memory.dmp
memory/4072-12-0x00007FFA138F0000-0x00007FFA13901000-memory.dmp
memory/4072-14-0x00007FFA138B0000-0x00007FFA138C1000-memory.dmp
memory/4072-13-0x00007FFA138D0000-0x00007FFA138ED000-memory.dmp
memory/4072-15-0x00007FFA12ED0000-0x00007FFA130D0000-memory.dmp
memory/4072-16-0x00007FFA00E90000-0x00007FFA01F3B000-memory.dmp
memory/4072-17-0x00007FFA13870000-0x00007FFA138AF000-memory.dmp
memory/4072-18-0x00007FFA13840000-0x00007FFA13861000-memory.dmp
memory/4072-19-0x00007FFA13820000-0x00007FFA13838000-memory.dmp
memory/4072-21-0x00007FFA137E0000-0x00007FFA137F1000-memory.dmp
memory/4072-20-0x00007FFA13800000-0x00007FFA13811000-memory.dmp
memory/4072-24-0x00007FFA13780000-0x00007FFA13791000-memory.dmp
memory/4072-23-0x00007FFA137A0000-0x00007FFA137BB000-memory.dmp
memory/4072-22-0x00007FFA137C0000-0x00007FFA137D1000-memory.dmp
memory/4072-26-0x00007FFA12E80000-0x00007FFA12EB0000-memory.dmp
memory/4072-25-0x00007FFA12EB0000-0x00007FFA12EC8000-memory.dmp
memory/4072-27-0x00007FFA12BE0000-0x00007FFA12C47000-memory.dmp
memory/4072-28-0x00007FFA09090000-0x00007FFA090FF000-memory.dmp
memory/4072-29-0x00007FFA12E60000-0x00007FFA12E71000-memory.dmp
memory/4072-31-0x00007FFA12BC0000-0x00007FFA12BD1000-memory.dmp
memory/4072-30-0x00007FFA12E40000-0x00007FFA12E57000-memory.dmp
memory/4072-35-0x00007FFA12A70000-0x00007FFA12A81000-memory.dmp
memory/4072-34-0x00007FFA12B10000-0x00007FFA12B23000-memory.dmp
memory/4072-33-0x00007FFA12B30000-0x00007FFA12B5F000-memory.dmp
memory/4072-32-0x00007FFA07E40000-0x00007FFA07E97000-memory.dmp
memory/4072-36-0x00007FFA00DC0000-0x00007FFA00E85000-memory.dmp
memory/4072-37-0x00007FFA12A50000-0x00007FFA12A62000-memory.dmp
memory/4072-38-0x00007FFA07DD0000-0x00007FFA07DE1000-memory.dmp
memory/4072-39-0x00007FFA06E90000-0x00007FFA06EA4000-memory.dmp
memory/4072-40-0x00007FFA06E70000-0x00007FFA06E82000-memory.dmp
memory/4072-41-0x00007FFA02340000-0x00007FFA02354000-memory.dmp
memory/4072-44-0x00007FFA022E0000-0x00007FFA022F5000-memory.dmp
memory/4072-45-0x00007FFA00DA0000-0x00007FFA00DB4000-memory.dmp
memory/4072-43-0x00007FFA02300000-0x00007FFA02316000-memory.dmp
memory/4072-42-0x00007FFA02320000-0x00007FFA0233E000-memory.dmp
memory/4072-46-0x00007FFA00D70000-0x00007FFA00D9C000-memory.dmp
memory/4072-47-0x00007FFA00D50000-0x00007FFA00D62000-memory.dmp
memory/4072-48-0x00007FFA00D20000-0x00007FFA00D50000-memory.dmp
memory/4072-49-0x00007FFA00D00000-0x00007FFA00D17000-memory.dmp
memory/4072-50-0x00007FF9FF550000-0x00007FFA00D00000-memory.dmp
memory/4072-51-0x00007FF9FF530000-0x00007FF9FF541000-memory.dmp
memory/4072-52-0x00007FF9FF510000-0x00007FF9FF522000-memory.dmp
memory/4072-53-0x00007FF9FF390000-0x00007FF9FF508000-memory.dmp
memory/4072-54-0x00007FF9FF370000-0x00007FF9FF387000-memory.dmp
memory/4072-55-0x00007FF9FF310000-0x00007FF9FF366000-memory.dmp
memory/4072-56-0x00007FF9FF2E0000-0x00007FF9FF308000-memory.dmp
memory/4072-57-0x00007FF9FF2B0000-0x00007FF9FF2D4000-memory.dmp
memory/4072-58-0x00007FFA18DC0000-0x00007FFA18DD0000-memory.dmp
memory/4072-60-0x00000289894E0000-0x0000028989555000-memory.dmp
memory/4072-59-0x00007FF9FF290000-0x00007FF9FF2A6000-memory.dmp
memory/4072-61-0x0000028989560000-0x00000289895C2000-memory.dmp
memory/4072-65-0x00007FF9FECA0000-0x00007FF9FECB2000-memory.dmp
memory/4072-64-0x00007FF9FECC0000-0x00007FF9FECD1000-memory.dmp
memory/4072-63-0x00007FF9FF110000-0x00007FF9FF125000-memory.dmp
memory/4072-62-0x00007FF9FF130000-0x00007FF9FF19D000-memory.dmp
memory/4072-66-0x00007FF9FEB20000-0x00007FF9FEC9A000-memory.dmp