808b91284910cc3dcc129c09437abac4ce57cfa8e8f1099cb4310583c75cdb4e

Analysis

max time kernel
1790s
max time network
1587s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
01/10/2024, 20:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

El Chips Ad Custom Night/resources/app/assets/373adfc30b0253bff90c494b9606173f.wav
Size

5.7MB
MD5

373adfc30b0253bff90c494b9606173f
SHA1

f9db81e6bb587413f31b7e7a8fdd73d88819577d
SHA256

67163f76b671929e8bf79ad7363581ad04f6f2c60d0b77f4ce05fc5cfe2c5c4c
SHA512

acd8fdf30eeb2ec9da6b27d78cffc9dab2513c0710d29b8311b5579c82afda783783e9224710d487e27fa73f303be84f46784f0f1d1056fb01d9d41d6bf5d4a3
SSDEEP

98304:EksE0HxCHjc+yLZ2IYf7hppcUswGO1DrrVjWZvAgLh4BXukneb9un+X9ZWuNiN:Zs+HjRyV2XFppUwDrrVjW9hiLebW+X9G

Score

1^/10

Malware Config

Signatures

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2840	vlc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2840	vlc.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2004	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2004	AUDIODG.EXE
Token: 33	2840	vlc.exe
Token: SeIncBasePriorityPrivilege	2840	vlc.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
2840	vlc.exe
2840	vlc.exe
2840	vlc.exe
2840	vlc.exe
2840	vlc.exe
2840	vlc.exe
2840	vlc.exe
2840	vlc.exe
2840	vlc.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
2840	vlc.exe
2840	vlc.exe
2840	vlc.exe
2840	vlc.exe
2840	vlc.exe
2840	vlc.exe
2840	vlc.exe
2840	vlc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2840	vlc.exe

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\El Chips Ad Custom Night\resources\app\assets\373adfc30b0253bff90c494b9606173f.wav"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2840

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3e4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2840-8-0x00007FFA61590000-0x00007FFA615C4000-memory.dmp

Filesize
208KB

Download
memory/2840-7-0x00007FF63F560000-0x00007FF63F658000-memory.dmp

Filesize
992KB

Download
memory/2840-16-0x00007FFA5FBA0000-0x00007FFA5FBB1000-memory.dmp

Filesize
68KB

Download
memory/2840-9-0x00007FFA5F540000-0x00007FFA5F7F6000-memory.dmp

Filesize
2.7MB

Download
memory/2840-15-0x00007FFA61510000-0x00007FFA6152D000-memory.dmp

Filesize
116KB

Download
memory/2840-17-0x00007FFA5F180000-0x00007FFA5F38B000-memory.dmp

Filesize
2.0MB

Download
memory/2840-14-0x00007FFA61530000-0x00007FFA61541000-memory.dmp

Filesize
68KB

Download
memory/2840-13-0x00007FFA61550000-0x00007FFA61567000-memory.dmp

Filesize
92KB

Download
memory/2840-12-0x00007FFA61570000-0x00007FFA61581000-memory.dmp

Filesize
68KB

Download
memory/2840-11-0x00007FFA61860000-0x00007FFA61877000-memory.dmp

Filesize
92KB

Download
memory/2840-10-0x00007FFA61E60000-0x00007FFA61E78000-memory.dmp

Filesize
96KB

Download
memory/2840-25-0x00007FFA5F120000-0x00007FFA5F13B000-memory.dmp

Filesize
108KB

Download
memory/2840-24-0x00007FFA5F140000-0x00007FFA5F151000-memory.dmp

Filesize
68KB

Download
memory/2840-23-0x00007FFA5F160000-0x00007FFA5F171000-memory.dmp

Filesize
68KB

Download
memory/2840-22-0x00007FFA5F9C0000-0x00007FFA5F9D1000-memory.dmp

Filesize
68KB

Download
memory/2840-21-0x00007FFA5FB80000-0x00007FFA5FB98000-memory.dmp

Filesize
96KB

Download
memory/2840-20-0x00007FFA5F9E0000-0x00007FFA5FA01000-memory.dmp

Filesize
132KB

Download
memory/2840-19-0x00007FFA5FA10000-0x00007FFA5FA51000-memory.dmp

Filesize
260KB

Download
memory/2840-18-0x00007FFA4D540000-0x00007FFA4E5F0000-memory.dmp

Filesize
16.7MB

Download