1381fa3fc79389ad8e9c2f4acffda477c4b5c6e45a07fec9de523de30ee9efa8

Resubmissions

02/09/2024, 19:47

240902-yhtwnawbqm 8

02/09/2024, 19:44

02/09/2024, 16:42

02/09/2024, 04:27

02/09/2024, 04:25

02/09/2024, 04:23

02/09/2024, 04:20

24/08/2024, 02:54

Analysis

max time kernel
1790s
max time network
1559s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
02/09/2024, 04:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sticking-out-your-gyatt-for-the-rizzler.mp3
Size

175KB
MD5

27b535b4401ff51e152ef5f6fdaa2b5c
SHA1

eec3bba56eae9ff73d527c3638f3515d1c60da9b
SHA256

1381fa3fc79389ad8e9c2f4acffda477c4b5c6e45a07fec9de523de30ee9efa8
SHA512

9e322aef6c0c41f16fd0e101b89766032240570addba1a3be77b48207bc60c50a9ec3fbe82da9925d8d878ef111b625e629c05ee3dc23e30df10f8c523c8515e
SSDEEP

3072:nU/Sk+yOMHjhLbJdTJ/ffFFxEuy1hqFXNQlPgoTzS+GpQE4pCUW4hkFTMRsHeV8L:nUK1yTdLbJrXPxEuy1jFJkpaxBV6

Score

1^/10

Malware Config

Signatures

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1640	vlc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1640	vlc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1640	vlc.exe
Token: SeIncBasePriorityPrivilege	1640	vlc.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
1640	vlc.exe
1640	vlc.exe
1640	vlc.exe
1640	vlc.exe
1640	vlc.exe
1640	vlc.exe
1640	vlc.exe
1640	vlc.exe
1640	vlc.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
1640	vlc.exe
1640	vlc.exe
1640	vlc.exe
1640	vlc.exe
1640	vlc.exe
1640	vlc.exe
1640	vlc.exe
1640	vlc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1640	vlc.exe

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\sticking-out-your-gyatt-for-the-rizzler.mp3"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1640-6-0x000007FEF80A0000-0x000007FEF80D4000-memory.dmp

Filesize
208KB

Download
memory/1640-5-0x000000013F780000-0x000000013F878000-memory.dmp

Filesize
992KB

Download
memory/1640-14-0x000007FEF7500000-0x000007FEF7511000-memory.dmp

Filesize
68KB

Download
memory/1640-12-0x000007FEF7540000-0x000007FEF7551000-memory.dmp

Filesize
68KB

Download
memory/1640-13-0x000007FEF7520000-0x000007FEF753D000-memory.dmp

Filesize
116KB

Download
memory/1640-11-0x000007FEF7560000-0x000007FEF7577000-memory.dmp

Filesize
92KB

Download
memory/1640-7-0x000007FEF68B0000-0x000007FEF6B66000-memory.dmp

Filesize
2.7MB

Download
memory/1640-10-0x000007FEF8080000-0x000007FEF8091000-memory.dmp

Filesize
68KB

Download
memory/1640-9-0x000007FEFAB30000-0x000007FEFAB47000-memory.dmp

Filesize
92KB

Download
memory/1640-8-0x000007FEFB760000-0x000007FEFB778000-memory.dmp

Filesize
96KB

Download
memory/1640-21-0x000007FEF6FB0000-0x000007FEF6FC1000-memory.dmp

Filesize
68KB

Download
memory/1640-25-0x000007FEF6F30000-0x000007FEF6F48000-memory.dmp

Filesize
96KB

Download
memory/1640-35-0x000007FEF53F0000-0x000007FEF5401000-memory.dmp

Filesize
68KB

Download
memory/1640-37-0x000007FEF3670000-0x000007FEF36C7000-memory.dmp

Filesize
348KB

Download
memory/1640-40-0x000007FEF3440000-0x000007FEF3452000-memory.dmp

Filesize
72KB

Download
memory/1640-39-0x000007FEF3460000-0x000007FEF3471000-memory.dmp

Filesize
68KB

Download
memory/1640-38-0x000007FEF3640000-0x000007FEF3668000-memory.dmp

Filesize
160KB

Download
memory/1640-15-0x000007FEF5800000-0x000007FEF68B0000-memory.dmp

Filesize
16.7MB

Download
memory/1640-36-0x000007FEF5320000-0x000007FEF53E5000-memory.dmp

Filesize
788KB

Download
memory/1640-34-0x000007FEF5410000-0x000007FEF5423000-memory.dmp

Filesize
76KB

Download
memory/1640-41-0x000007FEF32C0000-0x000007FEF343A000-memory.dmp

Filesize
1.5MB

Download
memory/1640-33-0x000007FEF5430000-0x000007FEF545F000-memory.dmp

Filesize
188KB

Download
memory/1640-32-0x000007FEF5460000-0x000007FEF54B7000-memory.dmp

Filesize
348KB

Download
memory/1640-31-0x000007FEF54C0000-0x000007FEF54D1000-memory.dmp

Filesize
68KB

Download
memory/1640-30-0x000007FEF54E0000-0x000007FEF54F8000-memory.dmp

Filesize
96KB

Download
memory/1640-29-0x000007FEF6EE0000-0x000007FEF6EF1000-memory.dmp

Filesize
68KB

Download
memory/1640-28-0x000007FEF5500000-0x000007FEF557C000-memory.dmp

Filesize
496KB

Download
memory/1640-27-0x000007FEF5580000-0x000007FEF55E7000-memory.dmp

Filesize
412KB

Download
memory/1640-26-0x000007FEF6F00000-0x000007FEF6F30000-memory.dmp

Filesize
192KB

Download
memory/1640-24-0x000007FEF6F50000-0x000007FEF6F61000-memory.dmp

Filesize
68KB

Download
memory/1640-23-0x000007FEF6F70000-0x000007FEF6F8B000-memory.dmp

Filesize
108KB

Download
memory/1640-22-0x000007FEF6F90000-0x000007FEF6FA1000-memory.dmp

Filesize
68KB

Download
memory/1640-20-0x000007FEF6FD0000-0x000007FEF6FE1000-memory.dmp

Filesize
68KB

Download
memory/1640-19-0x000007FEF6FF0000-0x000007FEF7008000-memory.dmp

Filesize
96KB

Download
memory/1640-18-0x000007FEF7010000-0x000007FEF7031000-memory.dmp

Filesize
132KB

Download
memory/1640-17-0x000007FEF7040000-0x000007FEF7081000-memory.dmp

Filesize
260KB

Download
memory/1640-16-0x000007FEF55F0000-0x000007FEF57FB000-memory.dmp

Filesize
2.0MB

Download
memory/1640-44-0x000007FEF68B0000-0x000007FEF6B66000-memory.dmp

Filesize
2.7MB

Download