Analysis

  • max time kernel
    138s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    30-05-2024 22:35

General

  • Target

    FizzyCheat.rar

  • Size

    65.4MB

  • MD5

    2841b69d5b51b4b47da33189a8b411b1

  • SHA1

    01f25d1ae52f4b657e1f1cef6be95c538835bf5f

  • SHA256

    2e992e8dec38852aa826e898b601fc3591b982b10162475704f3394e4bc5f0a9

  • SHA512

    54272c7371963380dec5b5d73749a5e47ef36133ae268cca980d1e649daa18426d6f83b38b61fb530148d7f2fc418a78e7a9407e96c6de138ca0264f34380530

  • SSDEEP

    1572864:WeQrhsjfHj9wrH7kdFgGwjbmBR9P3++GmJnR1HT5UVZoVDKA:W4HRaHwdDMCBRJGmBR1d0ZaDt

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\FizzyCheat.rar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2364
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\FizzyCheat.rar
      2⤵
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2256
      • C:\Program Files\VideoLAN\VLC\vlc.exe
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\FizzyCheat.rar"
        3⤵
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:2664

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini

    Filesize

    86B

    MD5

    74b9fb954e75a22593c8af07b109012a

    SHA1

    44e339cc361f8948084b4c296ecddd92716d118a

    SHA256

    6f1335919add21929992f0120305ea905400729a04bb616b66f04454ea143afb

    SHA512

    2a4c5abd0373dde5d6c501e9039e95bd8e166eff766fa875d4108961be7a7ecfef9feba11997e24de1358b69dd3d5c338a6f126cff7293e19840a362dbd74e2d

  • C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini.lock

    Filesize

    18B

    MD5

    2a4006ee7a5e9862693c9ca25470a226

    SHA1

    3f19ab02ed708349ce5f7e347a6d120237c02d20

    SHA256

    59938d1e769636ae0411c56d03b5af228f9b14e6bef2d33e4c1793468e3dd797

    SHA512

    64e078acacb9137395ffc78213b035ad4ca583137fcd15beadfba505b90ba70ced94339f9410aef33d1fbef00982facacb9b2bcc758d9e6c6c1e730b4a2c5d2b

  • memory/2664-92-0x000007FEFB510000-0x000007FEFB544000-memory.dmp

    Filesize

    208KB

  • memory/2664-91-0x000000013F2E0000-0x000000013F3D8000-memory.dmp

    Filesize

    992KB

  • memory/2664-94-0x000007FEFB810000-0x000007FEFB828000-memory.dmp

    Filesize

    96KB

  • memory/2664-96-0x000007FEF7BF0000-0x000007FEF7C01000-memory.dmp

    Filesize

    68KB

  • memory/2664-95-0x000007FEFB610000-0x000007FEFB627000-memory.dmp

    Filesize

    92KB

  • memory/2664-98-0x000007FEF7BB0000-0x000007FEF7BC1000-memory.dmp

    Filesize

    68KB

  • memory/2664-97-0x000007FEF7BD0000-0x000007FEF7BE7000-memory.dmp

    Filesize

    92KB

  • memory/2664-99-0x000007FEF7B90000-0x000007FEF7BAD000-memory.dmp

    Filesize

    116KB

  • memory/2664-100-0x000007FEF7B70000-0x000007FEF7B81000-memory.dmp

    Filesize

    68KB

  • memory/2664-93-0x000007FEF63C0000-0x000007FEF6674000-memory.dmp

    Filesize

    2.7MB

  • memory/2664-118-0x000007FEF4FE0000-0x000007FEF5004000-memory.dmp

    Filesize

    144KB

  • memory/2664-115-0x000007FEF6D20000-0x000007FEF6D31000-memory.dmp

    Filesize

    68KB

  • memory/2664-122-0x000007FEF4F50000-0x000007FEF4F62000-memory.dmp

    Filesize

    72KB

  • memory/2664-101-0x000007FEF5310000-0x000007FEF63BB000-memory.dmp

    Filesize

    16.7MB

  • memory/2664-121-0x000007FEF4F70000-0x000007FEF4F81000-memory.dmp

    Filesize

    68KB

  • memory/2664-120-0x000007FEF4F90000-0x000007FEF4FB3000-memory.dmp

    Filesize

    140KB

  • memory/2664-119-0x000007FEF4FC0000-0x000007FEF4FD7000-memory.dmp

    Filesize

    92KB

  • memory/2664-117-0x000007FEF5010000-0x000007FEF5038000-memory.dmp

    Filesize

    160KB

  • memory/2664-116-0x000007FEF5040000-0x000007FEF5096000-memory.dmp

    Filesize

    344KB

  • memory/2664-114-0x000007FEF50A0000-0x000007FEF510F000-memory.dmp

    Filesize

    444KB

  • memory/2664-113-0x000007FEF6920000-0x000007FEF6987000-memory.dmp

    Filesize

    412KB

  • memory/2664-112-0x000007FEF6D40000-0x000007FEF6D70000-memory.dmp

    Filesize

    192KB

  • memory/2664-111-0x000007FEF6D70000-0x000007FEF6D88000-memory.dmp

    Filesize

    96KB

  • memory/2664-110-0x000007FEF6F50000-0x000007FEF6F61000-memory.dmp

    Filesize

    68KB

  • memory/2664-109-0x000007FEF7950000-0x000007FEF796B000-memory.dmp

    Filesize

    108KB

  • memory/2664-108-0x000007FEF7970000-0x000007FEF7981000-memory.dmp

    Filesize

    68KB

  • memory/2664-107-0x000007FEF7990000-0x000007FEF79A1000-memory.dmp

    Filesize

    68KB

  • memory/2664-106-0x000007FEF79B0000-0x000007FEF79C1000-memory.dmp

    Filesize

    68KB

  • memory/2664-105-0x000007FEF7B10000-0x000007FEF7B28000-memory.dmp

    Filesize

    96KB

  • memory/2664-104-0x000007FEF79D0000-0x000007FEF79F1000-memory.dmp

    Filesize

    132KB

  • memory/2664-103-0x000007FEF7B30000-0x000007FEF7B6F000-memory.dmp

    Filesize

    252KB

  • memory/2664-102-0x000007FEF5110000-0x000007FEF5310000-memory.dmp

    Filesize

    2.0MB