Resubmissions

25/06/2024, 01:37

240625-b151baxamn 8

25/06/2024, 01:35

240625-bzvsystckh 7

Analysis

  • max time kernel
    300s
  • max time network
    255s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    25/06/2024, 01:35

General

  • Target

    Data/Soundtrack/5. Boss1.ogg

  • Size

    1.5MB

  • MD5

    71a5471ffacb93a4024669df9063ffd1

  • SHA1

    f3e0580e583bc190d1205fc278f23f5bce2e6c7b

  • SHA256

    c57d21b9741585dac0f4c659ec4e4f0dd0e2959ce48a7ebe30a8c837ad06f51c

  • SHA512

    7637183b04e7c7d58c74bc737eab364e754155f8b62dbe5d55664f3743328356313b70dc8d8f596108d013fd1d7feea7fe6eab7b876bee0521010c793164493e

  • SSDEEP

    24576:gbnrKahFsldV70hdlk+P2JZo9/w7W0uOFxJrzQLEAgCzq1ziO4KyffA6:4RrWH0hdl7/wC0uwrzQLvgCezDufJ

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Data\Soundtrack\5. Boss1.ogg"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:4688
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x3b4
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4688-8-0x00007FFF16060000-0x00007FFF16094000-memory.dmp

    Filesize

    208KB

  • memory/4688-7-0x00007FF63DC20000-0x00007FF63DD18000-memory.dmp

    Filesize

    992KB

  • memory/4688-16-0x00007FFF15F70000-0x00007FFF15F81000-memory.dmp

    Filesize

    68KB

  • memory/4688-9-0x00007FFF11450000-0x00007FFF11706000-memory.dmp

    Filesize

    2.7MB

  • memory/4688-17-0x00007FFF03CD0000-0x00007FFF03EDB000-memory.dmp

    Filesize

    2.0MB

  • memory/4688-15-0x00007FFF15F90000-0x00007FFF15FAD000-memory.dmp

    Filesize

    116KB

  • memory/4688-14-0x00007FFF15FB0000-0x00007FFF15FC1000-memory.dmp

    Filesize

    68KB

  • memory/4688-13-0x00007FFF15FD0000-0x00007FFF15FE7000-memory.dmp

    Filesize

    92KB

  • memory/4688-12-0x00007FFF15FF0000-0x00007FFF16001000-memory.dmp

    Filesize

    68KB

  • memory/4688-11-0x00007FFF16010000-0x00007FFF16027000-memory.dmp

    Filesize

    92KB

  • memory/4688-10-0x00007FFF16930000-0x00007FFF16948000-memory.dmp

    Filesize

    96KB

  • memory/4688-25-0x00007FFF12CE0000-0x00007FFF12CFB000-memory.dmp

    Filesize

    108KB

  • memory/4688-24-0x00007FFF12D00000-0x00007FFF12D11000-memory.dmp

    Filesize

    68KB

  • memory/4688-23-0x00007FFF12D20000-0x00007FFF12D31000-memory.dmp

    Filesize

    68KB

  • memory/4688-22-0x00007FFF12D40000-0x00007FFF12D51000-memory.dmp

    Filesize

    68KB

  • memory/4688-21-0x00007FFF15EB0000-0x00007FFF15EC8000-memory.dmp

    Filesize

    96KB

  • memory/4688-20-0x00007FFF15F40000-0x00007FFF15F61000-memory.dmp

    Filesize

    132KB

  • memory/4688-19-0x00007FFF12D60000-0x00007FFF12DA1000-memory.dmp

    Filesize

    260KB

  • memory/4688-18-0x00007FFF02C20000-0x00007FFF03CD0000-memory.dmp

    Filesize

    16.7MB

  • memory/4688-56-0x00007FFF02C20000-0x00007FFF03CD0000-memory.dmp

    Filesize

    16.7MB