Analysis

  • max time kernel
    590s
  • max time network
    360s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    27-05-2024 12:36

General

  • Target

    .minecraft/resources/music/calm3.ogg

  • Size

    2.1MB

  • MD5

    ff32c2bfea9a23555713ca1d0739ee06

  • SHA1

    14ae57a6bce3d4254daa8be2b098c2d99743cc3f

  • SHA256

    25984ac6655998148d10ab249ef2724f4cf1638aa67dbd0471fde0939d8db368

  • SHA512

    ff36276de70d5de1c9dc7834515d10e7acc7d0b29ffb62dfbce7657097ebc9c6ae07c6599d28863ba86230d85dfb7c4efe7864ad5d87de1aafa26afed4c2cbf5

  • SSDEEP

    49152:PocerAt7KkuE9j2nGDLffkHEEj+iZP8ZaXXsxfCSMctZ7EgBiOoNnnVv7lJTQYg:PnGABKkuE9jcOLffkORZSsBMct6+InVw

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\.minecraft\resources\music\calm3.ogg"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:1652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1652-5-0x000000013F520000-0x000000013F618000-memory.dmp

    Filesize

    992KB

  • memory/1652-6-0x000007FEF7A60000-0x000007FEF7A94000-memory.dmp

    Filesize

    208KB

  • memory/1652-9-0x000007FEFB6C0000-0x000007FEFB6D7000-memory.dmp

    Filesize

    92KB

  • memory/1652-8-0x000007FEFBF90000-0x000007FEFBFA8000-memory.dmp

    Filesize

    96KB

  • memory/1652-7-0x000007FEF6280000-0x000007FEF6534000-memory.dmp

    Filesize

    2.7MB

  • memory/1652-14-0x000007FEF7470000-0x000007FEF7481000-memory.dmp

    Filesize

    68KB

  • memory/1652-13-0x000007FEF7490000-0x000007FEF74AD000-memory.dmp

    Filesize

    116KB

  • memory/1652-12-0x000007FEF74B0000-0x000007FEF74C1000-memory.dmp

    Filesize

    68KB

  • memory/1652-11-0x000007FEF7A20000-0x000007FEF7A37000-memory.dmp

    Filesize

    92KB

  • memory/1652-10-0x000007FEF7AD0000-0x000007FEF7AE1000-memory.dmp

    Filesize

    68KB

  • memory/1652-15-0x000007FEF6080000-0x000007FEF6280000-memory.dmp

    Filesize

    2.0MB

  • memory/1652-18-0x000007FEF6EB0000-0x000007FEF6ED1000-memory.dmp

    Filesize

    132KB

  • memory/1652-27-0x000007FEF4F60000-0x000007FEF4FC7000-memory.dmp

    Filesize

    412KB

  • memory/1652-31-0x000007FEF4D10000-0x000007FEF4E88000-memory.dmp

    Filesize

    1.5MB

  • memory/1652-41-0x000007FEF49D0000-0x000007FEF4B4A000-memory.dmp

    Filesize

    1.5MB

  • memory/1652-40-0x000007FEF4B50000-0x000007FEF4B62000-memory.dmp

    Filesize

    72KB

  • memory/1652-16-0x000007FEF4FD0000-0x000007FEF607B000-memory.dmp

    Filesize

    16.7MB

  • memory/1652-39-0x000007FEF4B70000-0x000007FEF4B81000-memory.dmp

    Filesize

    68KB

  • memory/1652-38-0x000007FEF4BB0000-0x000007FEF4BC5000-memory.dmp

    Filesize

    84KB

  • memory/1652-37-0x000007FEF4BD0000-0x000007FEF4C95000-memory.dmp

    Filesize

    788KB

  • memory/1652-36-0x000007FEF4CA0000-0x000007FEF4CB6000-memory.dmp

    Filesize

    88KB

  • memory/1652-35-0x000007FEF4CC0000-0x000007FEF4CD1000-memory.dmp

    Filesize

    68KB

  • memory/1652-34-0x000007FEF4CE0000-0x000007FEF4D0F000-memory.dmp

    Filesize

    188KB

  • memory/1652-33-0x000007FEF7AC0000-0x000007FEF7AD0000-memory.dmp

    Filesize

    64KB

  • memory/1652-32-0x000007FEF68B0000-0x000007FEF68C7000-memory.dmp

    Filesize

    92KB

  • memory/1652-30-0x000007FEF4E90000-0x000007FEF4EEC000-memory.dmp

    Filesize

    368KB

  • memory/1652-29-0x000007FEF68D0000-0x000007FEF68E1000-memory.dmp

    Filesize

    68KB

  • memory/1652-28-0x000007FEF4EF0000-0x000007FEF4F5F000-memory.dmp

    Filesize

    444KB

  • memory/1652-26-0x000007FEF68F0000-0x000007FEF6920000-memory.dmp

    Filesize

    192KB

  • memory/1652-25-0x000007FEF6920000-0x000007FEF6938000-memory.dmp

    Filesize

    96KB

  • memory/1652-24-0x000007FEF6940000-0x000007FEF6951000-memory.dmp

    Filesize

    68KB

  • memory/1652-23-0x000007FEF6960000-0x000007FEF697B000-memory.dmp

    Filesize

    108KB

  • memory/1652-22-0x000007FEF6980000-0x000007FEF6991000-memory.dmp

    Filesize

    68KB

  • memory/1652-21-0x000007FEF69A0000-0x000007FEF69B1000-memory.dmp

    Filesize

    68KB

  • memory/1652-20-0x000007FEF6E90000-0x000007FEF6EA1000-memory.dmp

    Filesize

    68KB

  • memory/1652-19-0x000007FEF7450000-0x000007FEF7468000-memory.dmp

    Filesize

    96KB

  • memory/1652-17-0x000007FEF6EE0000-0x000007FEF6F1F000-memory.dmp

    Filesize

    252KB