Resubmissions

25/06/2024, 01:37

240625-b151baxamn 8

25/06/2024, 01:35

240625-bzvsystckh 7

Analysis

  • max time kernel
    290s
  • max time network
    303s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    25/06/2024, 01:35

General

  • Target

    Data/Soundtrack/8. GameOver.ogg

  • Size

    149KB

  • MD5

    a817e39df1989eedee0c66988f90dfd9

  • SHA1

    6166f2fbdec8e1acde9ce416fe39c01f50d93919

  • SHA256

    9f13859f1e30489b1d49ee1fee13b2d12ff6b09cb3dc0da99444cd1306f292b0

  • SHA512

    1e0c2054d9c811af3677cbba2cc633b2060af40aa64d84b0fe0cc18095747ab77470ea840f715edf6d84e0b41b518b05b5e74f7495da651350360347d9d32eb5

  • SSDEEP

    3072:bsUt3ztP67utxdNFZ+51ZpGEYymtk9dKG4ZPgDipFhyqmiCv0chEnjNt/x:4UX62BwpGVySR5gep/7ov0chm7

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Data\Soundtrack\8. GameOver.ogg"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:1692
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x3cc
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1692-8-0x00007FF847050000-0x00007FF847084000-memory.dmp

    Filesize

    208KB

  • memory/1692-7-0x00007FF62B320000-0x00007FF62B418000-memory.dmp

    Filesize

    992KB

  • memory/1692-16-0x00007FF844730000-0x00007FF844741000-memory.dmp

    Filesize

    68KB

  • memory/1692-15-0x00007FF844750000-0x00007FF84476D000-memory.dmp

    Filesize

    116KB

  • memory/1692-14-0x00007FF846FD0000-0x00007FF846FE1000-memory.dmp

    Filesize

    68KB

  • memory/1692-13-0x00007FF846FF0000-0x00007FF847007000-memory.dmp

    Filesize

    92KB

  • memory/1692-10-0x00007FF847D50000-0x00007FF847D68000-memory.dmp

    Filesize

    96KB

  • memory/1692-12-0x00007FF847010000-0x00007FF847021000-memory.dmp

    Filesize

    68KB

  • memory/1692-11-0x00007FF847030000-0x00007FF847047000-memory.dmp

    Filesize

    92KB

  • memory/1692-9-0x00007FF843230000-0x00007FF8434E6000-memory.dmp

    Filesize

    2.7MB

  • memory/1692-17-0x00007FF834760000-0x00007FF83496B000-memory.dmp

    Filesize

    2.0MB

  • memory/1692-20-0x00007FF8444E0000-0x00007FF844501000-memory.dmp

    Filesize

    132KB

  • memory/1692-25-0x00007FF844400000-0x00007FF84441B000-memory.dmp

    Filesize

    108KB

  • memory/1692-24-0x00007FF844480000-0x00007FF844491000-memory.dmp

    Filesize

    68KB

  • memory/1692-23-0x00007FF8444A0000-0x00007FF8444B1000-memory.dmp

    Filesize

    68KB

  • memory/1692-22-0x00007FF8444C0000-0x00007FF8444D1000-memory.dmp

    Filesize

    68KB

  • memory/1692-21-0x00007FF844710000-0x00007FF844728000-memory.dmp

    Filesize

    96KB

  • memory/1692-19-0x00007FF844510000-0x00007FF844551000-memory.dmp

    Filesize

    260KB

  • memory/1692-18-0x00007FF8336B0000-0x00007FF834760000-memory.dmp

    Filesize

    16.7MB

  • memory/1692-56-0x00007FF8336B0000-0x00007FF834760000-memory.dmp

    Filesize

    16.7MB