Resubmissions

02/09/2024, 19:47

240902-yhtwnawbqm 8

02/09/2024, 19:44

240902-yf71haxbmd 6

02/09/2024, 16:42

240902-t7z2ravemf 6

02/09/2024, 04:27

240902-e28pda1gjm 6

02/09/2024, 04:25

240902-e2agks1fqp 6

02/09/2024, 04:23

240902-ez6f8ssepa 6

02/09/2024, 04:20

240902-eydd3asela 6

24/08/2024, 02:54

240824-dd53xashql 10

Analysis

  • max time kernel
    1132s
  • max time network
    1793s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    02/09/2024, 16:42

General

  • Target

    sticking-out-your-gyatt-for-the-rizzler.mp3

  • Size

    175KB

  • MD5

    27b535b4401ff51e152ef5f6fdaa2b5c

  • SHA1

    eec3bba56eae9ff73d527c3638f3515d1c60da9b

  • SHA256

    1381fa3fc79389ad8e9c2f4acffda477c4b5c6e45a07fec9de523de30ee9efa8

  • SHA512

    9e322aef6c0c41f16fd0e101b89766032240570addba1a3be77b48207bc60c50a9ec3fbe82da9925d8d878ef111b625e629c05ee3dc23e30df10f8c523c8515e

  • SSDEEP

    3072:nU/Sk+yOMHjhLbJdTJ/ffFFxEuy1hqFXNQlPgoTzS+GpQE4pCUW4hkFTMRsHeV8L:nUK1yTdLbJrXPxEuy1jFJkpaxBV6

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 44 IoCs
  • Suspicious use of SendNotifyMessage 41 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\sticking-out-your-gyatt-for-the-rizzler.mp3"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:3024
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1704
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7bf9758,0x7fef7bf9768,0x7fef7bf9778
      2⤵
        PID:2100
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1152 --field-trial-handle=1112,i,16710766446755935303,12311066976100176557,131072 /prefetch:2
        2⤵
          PID:912
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1400 --field-trial-handle=1112,i,16710766446755935303,12311066976100176557,131072 /prefetch:8
          2⤵
            PID:1000
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1576 --field-trial-handle=1112,i,16710766446755935303,12311066976100176557,131072 /prefetch:8
            2⤵
              PID:572
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2080 --field-trial-handle=1112,i,16710766446755935303,12311066976100176557,131072 /prefetch:1
              2⤵
                PID:1908
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2280 --field-trial-handle=1112,i,16710766446755935303,12311066976100176557,131072 /prefetch:1
                2⤵
                  PID:1460
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1652 --field-trial-handle=1112,i,16710766446755935303,12311066976100176557,131072 /prefetch:2
                  2⤵
                    PID:2732
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2932 --field-trial-handle=1112,i,16710766446755935303,12311066976100176557,131072 /prefetch:1
                    2⤵
                      PID:2828
                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --reenable-autoupdates --system-level
                      2⤵
                        PID:2456
                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13f4e7688,0x13f4e7698,0x13f4e76a8
                          3⤵
                            PID:284
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3616 --field-trial-handle=1112,i,16710766446755935303,12311066976100176557,131072 /prefetch:8
                          2⤵
                            PID:496
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3708 --field-trial-handle=1112,i,16710766446755935303,12311066976100176557,131072 /prefetch:1
                            2⤵
                              PID:1888
                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                            1⤵
                              PID:900

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

                              Filesize

                              211KB

                              MD5

                              e7226392c938e4e604d2175eb9f43ca1

                              SHA1

                              2098293f39aa0bcdd62e718f9212d9062fa283ab

                              SHA256

                              d46ec08b6c29c4ca56cecbf73149cc66ebd902197590fe28cd65dad52a08c4e1

                              SHA512

                              63a4b99101c790d40a813db9e0d5fde21a64ccaf60a6009ead027920dbbdb52cc262af829e5c4140f3702a559c7ac46efa89622d76d45b4b49a9ce01625ef145

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

                              Filesize

                              16B

                              MD5

                              aefd77f47fb84fae5ea194496b44c67a

                              SHA1

                              dcfbb6a5b8d05662c4858664f81693bb7f803b82

                              SHA256

                              4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

                              SHA512

                              b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                              Filesize

                              264KB

                              MD5

                              f50f89a0a91564d0b8a211f8921aa7de

                              SHA1

                              112403a17dd69d5b9018b8cede023cb3b54eab7d

                              SHA256

                              b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                              SHA512

                              bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              db3a1aa532c502f65c5d743a9b0964ea

                              SHA1

                              4b49d53977cfe1bf705ab714114c88e94e57c4ff

                              SHA256

                              541954fe29f2869aa0d317c4c17d658afc0ff204e614e3d5d56621feb2a6eabb

                              SHA512

                              34c428649142779bd0ffe9c5a33acf8e538a3ed8a31015b75e79844c94ef342f431532c13730ea19c13b52afe1ce9b3b616bd150a2c87a6e7fc51fc503ce34e4

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              aca30fe60a5e44abaec33b59e475a9be

                              SHA1

                              2784ef3b646e131b4c1288bb0922f00d359c07cc

                              SHA256

                              cfafe9f64b6ac7c0151ea3c8057486176f0fafa491d6e1d27f3257d1633eddba

                              SHA512

                              adc78ec6cab6edee8072fa8e0433815e7216394754f3c1cee66f3a360a4dfbba118d235da2e8f0fc258d55eafb6bf362e0e586ac3acd384cdbd93f5c34e6e2d9

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              3734368b6b3f063c4b7a6e9f6e7b5fab

                              SHA1

                              81714f709783e9bbb700249b6c33e2262dc5b66f

                              SHA256

                              21bbd8d05d65966c3a5d8f5abb9c92813b4a1e81dbd77ca46bbfb8f54f9c8432

                              SHA512

                              8ba717a1e3708a6d4491a4fd767180800232a52a4b48559cf07b7123197bcea72e348d45ed8ad4b01a0c940a0ffb587bd3d031e0e6fc1e2c2ebd57cd735487f4

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              5KB

                              MD5

                              68bb979933944389526e0d8a1749a627

                              SHA1

                              1e19f871bfcc36e2041959df164553ee9e06b9e9

                              SHA256

                              200a31246d3ff7e30ab07e3a56037091b6421a3bae707ab30831f74e82807969

                              SHA512

                              4924ea02c0a64ac98e36f68d2dabdaa90f84ef93ca0f94b99af1a1f38ffd96301e1a2b0d00cd4ffc4bf97c6305a2110f83dc4f53d35f39efdc3478ad00712958

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              5KB

                              MD5

                              262c81ab2435373555976d2ffe413dc8

                              SHA1

                              6e61ec28342629e1a0bfeed69f029f6d027e7fe8

                              SHA256

                              f4bac6b0c6fadee4406c68cf0179e04ca9164bffbb6080ddeacafa45f2caf0c1

                              SHA512

                              2aabc50b9b4ad84d80643a435c43436023bc1b9a464eb479452833b51764fca4ed9f981c2d4f49507f8b158717f5b3f801ac96fde0d57fabe3d1f16d70923585

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

                              Filesize

                              16B

                              MD5

                              18e723571b00fb1694a3bad6c78e4054

                              SHA1

                              afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                              SHA256

                              8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                              SHA512

                              43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                            • memory/3024-43-0x000007FEF3B50000-0x000007FEF3BB2000-memory.dmp

                              Filesize

                              392KB

                            • memory/3024-36-0x000007FEF5910000-0x000007FEF59D5000-memory.dmp

                              Filesize

                              788KB

                            • memory/3024-11-0x000007FEF7A70000-0x000007FEF7A87000-memory.dmp

                              Filesize

                              92KB

                            • memory/3024-10-0x000007FEF7A90000-0x000007FEF7AA1000-memory.dmp

                              Filesize

                              68KB

                            • memory/3024-9-0x000007FEF8960000-0x000007FEF8977000-memory.dmp

                              Filesize

                              92KB

                            • memory/3024-15-0x000007FEF6CB0000-0x000007FEF6EBB000-memory.dmp

                              Filesize

                              2.0MB

                            • memory/3024-25-0x000007FEF72D0000-0x000007FEF72E8000-memory.dmp

                              Filesize

                              96KB

                            • memory/3024-27-0x000007FEF5B90000-0x000007FEF5BF7000-memory.dmp

                              Filesize

                              412KB

                            • memory/3024-32-0x000007FEF5A50000-0x000007FEF5AA7000-memory.dmp

                              Filesize

                              348KB

                            • memory/3024-35-0x000007FEF59E0000-0x000007FEF59F1000-memory.dmp

                              Filesize

                              68KB

                            • memory/3024-47-0x000007FEF3A60000-0x000007FEF3A72000-memory.dmp

                              Filesize

                              72KB

                            • memory/3024-46-0x000007FEF3A80000-0x000007FEF3A91000-memory.dmp

                              Filesize

                              68KB

                            • memory/3024-48-0x000007FEF38E0000-0x000007FEF3A5A000-memory.dmp

                              Filesize

                              1.5MB

                            • memory/3024-16-0x000007FEF5C00000-0x000007FEF6CB0000-memory.dmp

                              Filesize

                              16.7MB

                            • memory/3024-45-0x000007FEF3AC0000-0x000007FEF3AD5000-memory.dmp

                              Filesize

                              84KB

                            • memory/3024-44-0x000007FEF3AE0000-0x000007FEF3B4D000-memory.dmp

                              Filesize

                              436KB

                            • memory/3024-13-0x000007FEF7630000-0x000007FEF764D000-memory.dmp

                              Filesize

                              116KB

                            • memory/3024-42-0x000007FEF3BC0000-0x000007FEF3C02000-memory.dmp

                              Filesize

                              264KB

                            • memory/3024-41-0x000007FEF3C10000-0x000007FEF3C26000-memory.dmp

                              Filesize

                              88KB

                            • memory/3024-40-0x000007FEF7A60000-0x000007FEF7A70000-memory.dmp

                              Filesize

                              64KB

                            • memory/3024-39-0x000007FEF3C30000-0x000007FEF3C54000-memory.dmp

                              Filesize

                              144KB

                            • memory/3024-38-0x000007FEF3C60000-0x000007FEF3C88000-memory.dmp

                              Filesize

                              160KB

                            • memory/3024-37-0x000007FEF3C90000-0x000007FEF3CE7000-memory.dmp

                              Filesize

                              348KB

                            • memory/3024-12-0x000007FEF7650000-0x000007FEF7661000-memory.dmp

                              Filesize

                              68KB

                            • memory/3024-34-0x000007FEF5A00000-0x000007FEF5A13000-memory.dmp

                              Filesize

                              76KB

                            • memory/3024-33-0x000007FEF5A20000-0x000007FEF5A4F000-memory.dmp

                              Filesize

                              188KB

                            • memory/3024-31-0x000007FEF5AB0000-0x000007FEF5AC1000-memory.dmp

                              Filesize

                              68KB

                            • memory/3024-30-0x000007FEF5AD0000-0x000007FEF5AE8000-memory.dmp

                              Filesize

                              96KB

                            • memory/3024-29-0x000007FEF5AF0000-0x000007FEF5B01000-memory.dmp

                              Filesize

                              68KB

                            • memory/3024-28-0x000007FEF5B10000-0x000007FEF5B8C000-memory.dmp

                              Filesize

                              496KB

                            • memory/3024-26-0x000007FEF72A0000-0x000007FEF72D0000-memory.dmp

                              Filesize

                              192KB

                            • memory/3024-24-0x000007FEF72F0000-0x000007FEF7301000-memory.dmp

                              Filesize

                              68KB

                            • memory/3024-23-0x000007FEF7310000-0x000007FEF732B000-memory.dmp

                              Filesize

                              108KB

                            • memory/3024-22-0x000007FEF7330000-0x000007FEF7341000-memory.dmp

                              Filesize

                              68KB

                            • memory/3024-21-0x000007FEF7350000-0x000007FEF7361000-memory.dmp

                              Filesize

                              68KB

                            • memory/3024-7-0x000007FEF6EC0000-0x000007FEF7176000-memory.dmp

                              Filesize

                              2.7MB

                            • memory/3024-14-0x000007FEF7610000-0x000007FEF7621000-memory.dmp

                              Filesize

                              68KB

                            • memory/3024-8-0x000007FEFBD60000-0x000007FEFBD78000-memory.dmp

                              Filesize

                              96KB

                            • memory/3024-6-0x000007FEF7BE0000-0x000007FEF7C14000-memory.dmp

                              Filesize

                              208KB

                            • memory/3024-5-0x000000013F7B0000-0x000000013F8A8000-memory.dmp

                              Filesize

                              992KB

                            • memory/3024-20-0x000007FEF7410000-0x000007FEF7421000-memory.dmp

                              Filesize

                              68KB

                            • memory/3024-19-0x000007FEF75F0000-0x000007FEF7608000-memory.dmp

                              Filesize

                              96KB

                            • memory/3024-18-0x000007FEF7370000-0x000007FEF7391000-memory.dmp

                              Filesize

                              132KB

                            • memory/3024-17-0x000007FEF7430000-0x000007FEF7471000-memory.dmp

                              Filesize

                              260KB

                            • memory/3024-51-0x000007FEF6EC0000-0x000007FEF7176000-memory.dmp

                              Filesize

                              2.7MB