Analysis
-
max time kernel
1395s -
max time network
1161s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
21-08-2024 16:56
Behavioral task
behavioral1
Sample
saeko-dating-simulator.rar
Resource
win11-20240802-en
windows11-21h2-x64
9 signatures
1800 seconds
General
-
Target
saeko-dating-simulator.rar
-
Size
48.0MB
-
MD5
95cb2de6d6a98480be1d2947e0b7237c
-
SHA1
db03aa48a2a2561dbea61a63ffdbf1a569fa3336
-
SHA256
dd1c257f0093628cc6a6b562fe3317c9cc2e94192fef5616c47c9a29e14964d4
-
SHA512
f3a0f56ba9ff2021ca918313c42a27fa797df69d2819541cbe867bc6ae54bb6cfc05641afac83b9d105489f788a456aea3ebf8737003e44cea67613603941307
-
SSDEEP
786432:jAYPh+xnSCbCAzBa4eoJaPRX/CMA2KYtaORkttSeomjdvVArbVkphVKmFKglSSkE:0Sr4eoJICMA2JFkPo0VAy/wVZ3JPpy
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings OpenWith.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1108 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 472 OpenWith.exe 1108 vlc.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 3532 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 3532 AUDIODG.EXE Token: 33 1108 vlc.exe Token: SeIncBasePriorityPrivilege 1108 vlc.exe -
Suspicious use of FindShellTrayWindow 32 IoCs
pid Process 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe -
Suspicious use of SendNotifyMessage 31 IoCs
pid Process 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe 1108 vlc.exe -
Suspicious use of SetWindowsHookEx 30 IoCs
pid Process 472 OpenWith.exe 472 OpenWith.exe 472 OpenWith.exe 472 OpenWith.exe 472 OpenWith.exe 472 OpenWith.exe 472 OpenWith.exe 472 OpenWith.exe 472 OpenWith.exe 472 OpenWith.exe 472 OpenWith.exe 472 OpenWith.exe 472 OpenWith.exe 472 OpenWith.exe 472 OpenWith.exe 472 OpenWith.exe 472 OpenWith.exe 472 OpenWith.exe 472 OpenWith.exe 472 OpenWith.exe 472 OpenWith.exe 472 OpenWith.exe 472 OpenWith.exe 472 OpenWith.exe 472 OpenWith.exe 472 OpenWith.exe 472 OpenWith.exe 472 OpenWith.exe 472 OpenWith.exe 1108 vlc.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 472 wrote to memory of 1108 472 OpenWith.exe 91 PID 472 wrote to memory of 1108 472 OpenWith.exe 91
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\saeko-dating-simulator.rar1⤵
- Modifies registry class
PID:5228
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\saeko-dating-simulator.rar"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1108
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004D01⤵
- Suspicious use of AdjustPrivilegeToken
PID:3532