Resubmissions
27-12-2022 21:27
221227-1atxssbf2y 1Analysis
-
max time kernel
127s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27-12-2022 21:27
Static task
static1
Behavioral task
behavioral1
Sample
RENDER AD.mp4
Resource
win7-20221111-en
windows7-x64
6 signatures
150 seconds
General
-
Target
RENDER AD.mp4
-
Size
154.1MB
-
MD5
74718c26a2b3d2a582cbcac46763c5d0
-
SHA1
7df60ffea7e6baf118eb4c18b0ff288de0bf421a
-
SHA256
e0dfaf3580a70994879e47259eee54df6483bd70d90575d597022f5b5f3b0793
-
SHA512
81201362e9efe49aca5ca9013fd0d2eab702d8ea006419836fb3a258c1e009e20b74e0a89588cd39b60261ea5636bd9db2a631f22773a75df95bf866c72e1042
-
SSDEEP
3145728:lSjYYxm6ZIkCHAchY+oqHOkNUzs8/zpp3E/5fikf/pLj7f94:lEYYw6ZihY+oDk2zsKvwfi0f7F4
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1180 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1180 vlc.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: 33 928 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 928 AUDIODG.EXE Token: 33 928 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 928 AUDIODG.EXE Token: 33 1180 vlc.exe Token: SeIncBasePriorityPrivilege 1180 vlc.exe -
Suspicious use of FindShellTrayWindow 37 IoCs
pid Process 1180 vlc.exe 1180 vlc.exe 1180 vlc.exe 1180 vlc.exe 1180 vlc.exe 1180 vlc.exe 1180 vlc.exe 1180 vlc.exe 1180 vlc.exe 1180 vlc.exe 1180 vlc.exe 1180 vlc.exe 1180 vlc.exe 1180 vlc.exe 1180 vlc.exe 1180 vlc.exe 1180 vlc.exe 1180 vlc.exe 1180 vlc.exe 1180 vlc.exe 1180 vlc.exe 1180 vlc.exe 1180 vlc.exe 1180 vlc.exe 1180 vlc.exe 1180 vlc.exe 1180 vlc.exe 1180 vlc.exe 1180 vlc.exe 1180 vlc.exe 1180 vlc.exe 1180 vlc.exe 1180 vlc.exe 1180 vlc.exe 1180 vlc.exe 1180 vlc.exe 1180 vlc.exe -
Suspicious use of SendNotifyMessage 9 IoCs
pid Process 1180 vlc.exe 1180 vlc.exe 1180 vlc.exe 1180 vlc.exe 1180 vlc.exe 1180 vlc.exe 1180 vlc.exe 1180 vlc.exe 1180 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1180 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\RENDER AD.mp4"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1180
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4901⤵
- Suspicious use of AdjustPrivilegeToken
PID:928