Analysis
-
max time kernel
39s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
22/03/2023, 14:06
Static task
static1
Behavioral task
behavioral1
Sample
42881_61127970_1679482048.wav
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
42881_61127970_1679482048.wav
Resource
win10v2004-20230220-en
General
-
Target
42881_61127970_1679482048.wav
-
Size
235KB
-
MD5
0755eedf2479b0cc7875abd7203596a6
-
SHA1
54eeeb3e60ea1d434c024850b398bb2dc57883f0
-
SHA256
2bf52438a3b3396edfdacd3406b0be45d8fd22a6ddf7ab28546125c7ab7f27f8
-
SHA512
6918e235d43f3c26627c9e789e78ac60ff7111c2db2546656ac1a3a4cfaeb8efe0d7cf5b8010bae72117e168611279479dd19852b3ce5c638714d5655e9c8cc7
-
SSDEEP
6144:Hjyyl47RkAhkHFqxewQjd6nAojufTZusSVfv9Gfw:HjyylSNewQjIAojufN6PGfw
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2008 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2008 vlc.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: 33 672 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 672 AUDIODG.EXE Token: 33 672 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 672 AUDIODG.EXE Token: 33 2008 vlc.exe Token: SeIncBasePriorityPrivilege 2008 vlc.exe -
Suspicious use of FindShellTrayWindow 10 IoCs
pid Process 2008 vlc.exe 2008 vlc.exe 2008 vlc.exe 2008 vlc.exe 2008 vlc.exe 2008 vlc.exe 2008 vlc.exe 2008 vlc.exe 2008 vlc.exe 2008 vlc.exe -
Suspicious use of SendNotifyMessage 9 IoCs
pid Process 2008 vlc.exe 2008 vlc.exe 2008 vlc.exe 2008 vlc.exe 2008 vlc.exe 2008 vlc.exe 2008 vlc.exe 2008 vlc.exe 2008 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2008 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\42881_61127970_1679482048.wav"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2008
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1881⤵
- Suspicious use of AdjustPrivilegeToken
PID:672
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
93KB
MD5478a4a09f4f74e97335cd4d5e9da7ab5
SHA13c4f1dc52a293f079095d0b0370428ec8e8f9315
SHA256884b59950669842f3c45e6da3480cd9a553538b951fb155b435b48ff38683974
SHA512e96719663cd264132a8e1ea8c3f8a148c778a0c68caa2468ba47629393605b197dd9e00efad91f389de9fcc77b04981a0cf87f785f3c645cdc9e4ebd98060ca1