Overview
overview
6Static
static
1Chica Videos.rar
windows7-x64
3Chica Videos.rar
windows10-2004-x64
3Chica Vide...p1.wmv
windows7-x64
1Chica Vide...p1.wmv
windows10-2004-x64
6Chica Vide...p2.wmv
windows7-x64
1Chica Vide...p2.wmv
windows10-2004-x64
6Chica Videos/cum.wmv
windows7-x64
1Chica Videos/cum.wmv
windows10-2004-x64
6Chica Vide...hj.wmv
windows7-x64
1Chica Vide...hj.wmv
windows10-2004-x64
6Chica Videos/idle.wmv
windows7-x64
1Chica Videos/idle.wmv
windows10-2004-x64
6Chica Vide...ro.wmv
windows7-x64
1Chica Vide...ro.wmv
windows10-2004-x64
6Chica Videos/lift.wmv
windows7-x64
1Chica Videos/lift.wmv
windows10-2004-x64
6Chica Vide...on.wmv
windows7-x64
1Chica Vide...on.wmv
windows10-2004-x64
6Chica Vide...le.wmv
windows7-x64
1Chica Vide...le.wmv
windows10-2004-x64
6Analysis
-
max time kernel
141s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
24-03-2023 22:38
Static task
static1
Behavioral task
behavioral1
Sample
Chica Videos.rar
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Chica Videos.rar
Resource
win10v2004-20230221-en
Behavioral task
behavioral3
Sample
Chica Videos/chicarap1.wmv
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
Chica Videos/chicarap1.wmv
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
Chica Videos/chicarap2.wmv
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
Chica Videos/chicarap2.wmv
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
Chica Videos/cum.wmv
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
Chica Videos/cum.wmv
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
Chica Videos/idle hj.wmv
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
Chica Videos/idle hj.wmv
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
Chica Videos/idle.wmv
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
Chica Videos/idle.wmv
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
Chica Videos/intro.wmv
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
Chica Videos/intro.wmv
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
Chica Videos/lift.wmv
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
Chica Videos/lift.wmv
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
Chica Videos/mission.wmv
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
Chica Videos/mission.wmv
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
Chica Videos/table.wmv
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
Chica Videos/table.wmv
Resource
win10v2004-20230221-en
General
-
Target
Chica Videos/table.wmv
-
Size
1.9MB
-
MD5
182beced5adce92ac95a0efd960f9173
-
SHA1
bc486c8dd8e23b432aa3a1a19ba929d8b9ee2882
-
SHA256
940223e836fae9340487d23394f59c77e0a7696c63987e6b245ebdd543d22994
-
SHA512
b49c53f8f17483ce553ea2075911c1eafb69f5c909ef3d6dcee7cc6c1a0729ee06230edb9c84e8e4cd924e5fef5707bf4cae830c5fdd63c387d8bb9d84103395
-
SSDEEP
49152:1VmVtf0A8QUa6V42a2Ij4OVY3xudHpejsUZSoI7H/sSt:1sVtf0j42lI0KYwdgdep
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1392 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1392 vlc.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: 33 812 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 812 AUDIODG.EXE Token: 33 812 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 812 AUDIODG.EXE Token: 33 1392 vlc.exe Token: SeIncBasePriorityPrivilege 1392 vlc.exe -
Suspicious use of FindShellTrayWindow 56 IoCs
pid Process 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe 1392 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1392 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Chica Videos\table.wmv"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1392
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1e01⤵
- Suspicious use of AdjustPrivilegeToken
PID:812