808b91284910cc3dcc129c09437abac4ce57cfa8e8f1099cb4310583c75cdb4e

Analysis

max time kernel
1791s
max time network
1581s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
01/10/2024, 20:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

El Chips Ad Custom Night/resources/app/assets/bb6039e2d2b80f0ebed05ce75a7578df.wav
Size

1.6MB
MD5

bb6039e2d2b80f0ebed05ce75a7578df
SHA1

05ea360f0d5283df528f6bddf78f5a917e7307a1
SHA256

3ed7d8447e61fd036a28ff1dcf8a308a7577bf4258eddd059a000b2bdbb3c47b
SHA512

4fdab0af131275175cdb6752ebe71f19d98e2a83cdc53afc7a8ad7e9086d90bbddb5ff541eb0686fa1702b36774c863aeb798d80583a6bc2c55adca013670f46
SSDEEP

24576:A0SntMHLIYiHvH8os+GjzAIXFE7wFzgck6LZnAHKZ+hzV:A0igsVH4+G/91CmY6LZnglzV

Score

1^/10

Malware Config

Signatures

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2968	vlc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2968	vlc.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1384	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1384	AUDIODG.EXE
Token: 33	2968	vlc.exe
Token: SeIncBasePriorityPrivilege	2968	vlc.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
2968	vlc.exe
2968	vlc.exe
2968	vlc.exe
2968	vlc.exe
2968	vlc.exe
2968	vlc.exe
2968	vlc.exe
2968	vlc.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
2968	vlc.exe
2968	vlc.exe
2968	vlc.exe
2968	vlc.exe
2968	vlc.exe
2968	vlc.exe
2968	vlc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2968	vlc.exe

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\El Chips Ad Custom Night\resources\app\assets\bb6039e2d2b80f0ebed05ce75a7578df.wav"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2968

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3d8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1384

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2968-8-0x00007FFD624B0000-0x00007FFD624E4000-memory.dmp

Filesize
208KB

Download
memory/2968-7-0x00007FF7CC4E0000-0x00007FF7CC5D8000-memory.dmp

Filesize
992KB

Download
memory/2968-16-0x00007FFD620B0000-0x00007FFD620C1000-memory.dmp

Filesize
68KB

Download
memory/2968-9-0x00007FFD5F2F0000-0x00007FFD5F5A6000-memory.dmp

Filesize
2.7MB

Download
memory/2968-15-0x00007FFD62430000-0x00007FFD6244D000-memory.dmp

Filesize
116KB

Download
memory/2968-17-0x00007FFD5F0E0000-0x00007FFD5F2EB000-memory.dmp

Filesize
2.0MB

Download
memory/2968-14-0x00007FFD62450000-0x00007FFD62461000-memory.dmp

Filesize
68KB

Download
memory/2968-13-0x00007FFD62470000-0x00007FFD62487000-memory.dmp

Filesize
92KB

Download
memory/2968-12-0x00007FFD62490000-0x00007FFD624A1000-memory.dmp

Filesize
68KB

Download
memory/2968-11-0x00007FFD62600000-0x00007FFD62617000-memory.dmp

Filesize
92KB

Download
memory/2968-10-0x00007FFD62EA0000-0x00007FFD62EB8000-memory.dmp

Filesize
96KB

Download
memory/2968-25-0x00007FFD5F060000-0x00007FFD5F07B000-memory.dmp

Filesize
108KB

Download
memory/2968-24-0x00007FFD5F080000-0x00007FFD5F091000-memory.dmp

Filesize
68KB

Download
memory/2968-23-0x00007FFD5F0A0000-0x00007FFD5F0B1000-memory.dmp

Filesize
68KB

Download
memory/2968-22-0x00007FFD5F0C0000-0x00007FFD5F0D1000-memory.dmp

Filesize
68KB

Download
memory/2968-21-0x00007FFD62010000-0x00007FFD62028000-memory.dmp

Filesize
96KB

Download
memory/2968-20-0x00007FFD62030000-0x00007FFD62051000-memory.dmp

Filesize
132KB

Download
memory/2968-19-0x00007FFD62060000-0x00007FFD620A1000-memory.dmp

Filesize
260KB

Download
memory/2968-18-0x00007FFD4DA70000-0x00007FFD4EB20000-memory.dmp

Filesize
16.7MB

Download
memory/2968-28-0x00007FFD5F2F0000-0x00007FFD5F5A6000-memory.dmp

Filesize
2.7MB

Download
memory/2968-37-0x00007FFD4DA70000-0x00007FFD4EB20000-memory.dmp

Filesize
16.7MB

Download