Overview
overview
10Static
static
7SpySheriff.zip
windows7-x64
1SpySheriff.zip
windows10-2004-x64
1IESecurity.dll
windows7-x64
6IESecurity.dll
windows10-2004-x64
6ProcMon.dll
windows7-x64
1ProcMon.dll
windows10-2004-x64
1ReadME.txt
windows7-x64
1ReadME.txt
windows10-2004-x64
1SpySheriff.dvm
windows7-x64
3SpySheriff.dvm
windows10-2004-x64
3SpySheriff.exe
windows7-x64
7SpySheriff.exe
windows10-2004-x64
8Uninstall.exe
windows7-x64
1Uninstall.exe
windows10-2004-x64
1base.avd
windows7-x64
3base.avd
windows10-2004-x64
3base001.avd
windows7-x64
3base001.avd
windows10-2004-x64
3base002.avd
windows7-x64
3base002.avd
windows10-2004-x64
3found.wav
windows7-x64
1found.wav
windows10-2004-x64
6heur000.dll
windows7-x64
1heur000.dll
windows10-2004-x64
1heur001.dll
windows7-x64
1heur001.dll
windows10-2004-x64
1heur002.dll
windows7-x64
4heur002.dll
windows10-2004-x64
4heur003.dll
windows7-x64
10heur003.dll
windows10-2004-x64
10notfound.wav
windows7-x64
1notfound.wav
windows10-2004-x64
6Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
23-04-2024 14:29
Behavioral task
behavioral1
Sample
SpySheriff.zip
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
SpySheriff.zip
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
IESecurity.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
IESecurity.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
ProcMon.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
ProcMon.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
ReadME.txt
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
ReadME.txt
Resource
win10v2004-20240412-en
Behavioral task
behavioral9
Sample
SpySheriff.dvm
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
SpySheriff.dvm
Resource
win10v2004-20240412-en
Behavioral task
behavioral11
Sample
SpySheriff.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
SpySheriff.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral13
Sample
Uninstall.exe
Resource
win7-20240215-en
Behavioral task
behavioral14
Sample
Uninstall.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
base.avd
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
base.avd
Resource
win10v2004-20240412-en
Behavioral task
behavioral17
Sample
base001.avd
Resource
win7-20240220-en
Behavioral task
behavioral18
Sample
base001.avd
Resource
win10v2004-20240412-en
Behavioral task
behavioral19
Sample
base002.avd
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
base002.avd
Resource
win10v2004-20240412-en
Behavioral task
behavioral21
Sample
found.wav
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
found.wav
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
heur000.dll
Resource
win7-20240215-en
Behavioral task
behavioral24
Sample
heur000.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral25
Sample
heur001.dll
Resource
win7-20231129-en
Behavioral task
behavioral26
Sample
heur001.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral27
Sample
heur002.dll
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
heur002.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral29
Sample
heur003.dll
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
heur003.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral31
Sample
notfound.wav
Resource
win7-20240220-en
Behavioral task
behavioral32
Sample
notfound.wav
Resource
win10v2004-20240412-en
General
-
Target
notfound.wav
-
Size
20KB
-
MD5
b6db2d81423853ca8e82bd42e04e9ab2
-
SHA1
cfe0832bd5b107c94a54dc3c64df930462955dcf
-
SHA256
05c118e5a69fb0603c4e4d6357d3b92e3aca6e93883955eb9ec08110edc65fd5
-
SHA512
56ab7ad06fa0e55f44674279e9957cb96b13b090c0a61dd613c062654c37da2bff3dcf4a7d765db313de7fa19bb859794d3c06dfdadca23e45acf7c5c5fa6c19
-
SSDEEP
384:fWkYjsRliyvEwE5KDNYRcxHw6m6PV7WnG2q5FN2Kli+C:fuj04yvEwEM6Rcxjt4Bm0
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
vlc.exepid process 2292 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
vlc.exepid process 2292 vlc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
vlc.exedescription pid process Token: 33 2292 vlc.exe Token: SeIncBasePriorityPrivilege 2292 vlc.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
Processes:
vlc.exepid process 2292 vlc.exe 2292 vlc.exe 2292 vlc.exe 2292 vlc.exe 2292 vlc.exe 2292 vlc.exe 2292 vlc.exe 2292 vlc.exe -
Suspicious use of SendNotifyMessage 7 IoCs
Processes:
vlc.exepid process 2292 vlc.exe 2292 vlc.exe 2292 vlc.exe 2292 vlc.exe 2292 vlc.exe 2292 vlc.exe 2292 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vlc.exepid process 2292 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\notfound.wav"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2292-5-0x000000013F210000-0x000000013F308000-memory.dmpFilesize
992KB
-
memory/2292-6-0x000007FEFA1E0000-0x000007FEFA214000-memory.dmpFilesize
208KB
-
memory/2292-7-0x000007FEF5880000-0x000007FEF5B34000-memory.dmpFilesize
2.7MB
-
memory/2292-8-0x000007FEFAF30000-0x000007FEFAF48000-memory.dmpFilesize
96KB
-
memory/2292-9-0x000007FEFA250000-0x000007FEFA267000-memory.dmpFilesize
92KB
-
memory/2292-10-0x000007FEF7300000-0x000007FEF7311000-memory.dmpFilesize
68KB
-
memory/2292-11-0x000007FEF7130000-0x000007FEF7147000-memory.dmpFilesize
92KB
-
memory/2292-12-0x000007FEF7090000-0x000007FEF70A1000-memory.dmpFilesize
68KB
-
memory/2292-13-0x000007FEF7070000-0x000007FEF708D000-memory.dmpFilesize
116KB
-
memory/2292-14-0x000007FEF5680000-0x000007FEF5880000-memory.dmpFilesize
2.0MB
-
memory/2292-15-0x000007FEF7050000-0x000007FEF7061000-memory.dmpFilesize
68KB
-
memory/2292-16-0x000007FEF6A60000-0x000007FEF6A9F000-memory.dmpFilesize
252KB
-
memory/2292-18-0x000007FEF6630000-0x000007FEF6648000-memory.dmpFilesize
96KB
-
memory/2292-17-0x000007FEF7020000-0x000007FEF7041000-memory.dmpFilesize
132KB
-
memory/2292-19-0x000007FEF45D0000-0x000007FEF567B000-memory.dmpFilesize
16.7MB
-
memory/2292-21-0x000007FEF6430000-0x000007FEF6441000-memory.dmpFilesize
68KB
-
memory/2292-20-0x000007FEF6450000-0x000007FEF6461000-memory.dmpFilesize
68KB
-
memory/2292-22-0x000007FEF6410000-0x000007FEF6421000-memory.dmpFilesize
68KB
-
memory/2292-23-0x000007FEF6050000-0x000007FEF606B000-memory.dmpFilesize
108KB
-
memory/2292-24-0x000007FEF6030000-0x000007FEF6041000-memory.dmpFilesize
68KB
-
memory/2292-25-0x000007FEF6010000-0x000007FEF6028000-memory.dmpFilesize
96KB
-
memory/2292-27-0x000007FEF5F20000-0x000007FEF5F87000-memory.dmpFilesize
412KB
-
memory/2292-26-0x000007FEF5F90000-0x000007FEF5FC0000-memory.dmpFilesize
192KB
-
memory/2292-28-0x000007FEF5EB0000-0x000007FEF5F1F000-memory.dmpFilesize
444KB
-
memory/2292-29-0x000007FEF45B0000-0x000007FEF45C1000-memory.dmpFilesize
68KB
-
memory/2292-31-0x000007FEF4520000-0x000007FEF4548000-memory.dmpFilesize
160KB
-
memory/2292-30-0x000007FEF4550000-0x000007FEF45A6000-memory.dmpFilesize
344KB
-
memory/2292-32-0x000007FEF44F0000-0x000007FEF4514000-memory.dmpFilesize
144KB
-
memory/2292-33-0x000007FEF44D0000-0x000007FEF44E7000-memory.dmpFilesize
92KB
-
memory/2292-34-0x000007FEF44A0000-0x000007FEF44C3000-memory.dmpFilesize
140KB
-
memory/2292-39-0x000007FEF4290000-0x000007FEF4408000-memory.dmpFilesize
1.5MB
-
memory/2292-40-0x000007FEF4270000-0x000007FEF4287000-memory.dmpFilesize
92KB
-
memory/2292-44-0x000007FEF4200000-0x000007FEF4216000-memory.dmpFilesize
88KB
-
memory/2292-43-0x000007FEF4220000-0x000007FEF4231000-memory.dmpFilesize
68KB
-
memory/2292-42-0x000007FEF4240000-0x000007FEF426F000-memory.dmpFilesize
188KB
-
memory/2292-47-0x000007FEF4180000-0x000007FEF4192000-memory.dmpFilesize
72KB
-
memory/2292-48-0x000007FEF4000000-0x000007FEF417A000-memory.dmpFilesize
1.5MB
-
memory/2292-49-0x000007FEF3FE0000-0x000007FEF3FF3000-memory.dmpFilesize
76KB
-
memory/2292-46-0x000007FEF41A0000-0x000007FEF41B1000-memory.dmpFilesize
68KB
-
memory/2292-45-0x000007FEF41E0000-0x000007FEF41F5000-memory.dmpFilesize
84KB
-
memory/2292-41-0x000007FEFA7B0000-0x000007FEFA7C0000-memory.dmpFilesize
64KB
-
memory/2292-54-0x000007FEF3F40000-0x000007FEF3F56000-memory.dmpFilesize
88KB
-
memory/2292-53-0x000007FEF3F60000-0x000007FEF3F71000-memory.dmpFilesize
68KB
-
memory/2292-52-0x000007FEF3F80000-0x000007FEF3F91000-memory.dmpFilesize
68KB
-
memory/2292-51-0x000007FEF3FA0000-0x000007FEF3FB1000-memory.dmpFilesize
68KB
-
memory/2292-50-0x000007FEF3FC0000-0x000007FEF3FD4000-memory.dmpFilesize
80KB
-
memory/2292-38-0x000007FEF4410000-0x000007FEF4423000-memory.dmpFilesize
76KB
-
memory/2292-37-0x000007FEF4430000-0x000007FEF4451000-memory.dmpFilesize
132KB
-
memory/2292-36-0x000007FEF4460000-0x000007FEF4472000-memory.dmpFilesize
72KB
-
memory/2292-35-0x000007FEF4480000-0x000007FEF4491000-memory.dmpFilesize
68KB