Analysis

  • max time kernel
    141s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    24-03-2023 22:38

General

  • Target

    Chica Videos/table.wmv

  • Size

    1.9MB

  • MD5

    182beced5adce92ac95a0efd960f9173

  • SHA1

    bc486c8dd8e23b432aa3a1a19ba929d8b9ee2882

  • SHA256

    940223e836fae9340487d23394f59c77e0a7696c63987e6b245ebdd543d22994

  • SHA512

    b49c53f8f17483ce553ea2075911c1eafb69f5c909ef3d6dcee7cc6c1a0729ee06230edb9c84e8e4cd924e5fef5707bf4cae830c5fdd63c387d8bb9d84103395

  • SSDEEP

    49152:1VmVtf0A8QUa6V42a2Ij4OVY3xudHpejsUZSoI7H/sSt:1sVtf0j42lI0KYwdgdep

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 56 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Chica Videos\table.wmv"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:1392
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x1e0
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:812

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1392-59-0x000000013FFD0000-0x00000001400C8000-memory.dmp

    Filesize

    992KB

  • memory/1392-60-0x000007FEF71B0000-0x000007FEF71E4000-memory.dmp

    Filesize

    208KB

  • memory/1392-61-0x000007FEF6D00000-0x000007FEF6FB4000-memory.dmp

    Filesize

    2.7MB

  • memory/1392-62-0x000007FEFBCA0000-0x000007FEFBCB8000-memory.dmp

    Filesize

    96KB

  • memory/1392-63-0x000007FEF7280000-0x000007FEF7297000-memory.dmp

    Filesize

    92KB

  • memory/1392-64-0x000007FEF7060000-0x000007FEF7071000-memory.dmp

    Filesize

    68KB

  • memory/1392-65-0x000007FEF6CE0000-0x000007FEF6CF7000-memory.dmp

    Filesize

    92KB

  • memory/1392-66-0x000007FEF6CC0000-0x000007FEF6CD1000-memory.dmp

    Filesize

    68KB

  • memory/1392-67-0x000007FEF6CA0000-0x000007FEF6CBD000-memory.dmp

    Filesize

    116KB

  • memory/1392-68-0x000007FEF6C80000-0x000007FEF6C91000-memory.dmp

    Filesize

    68KB

  • memory/1392-69-0x000007FEF5B60000-0x000007FEF6C0B000-memory.dmp

    Filesize

    16.7MB

  • memory/1392-70-0x000007FEF5960000-0x000007FEF5B60000-memory.dmp

    Filesize

    2.0MB

  • memory/1392-71-0x000007FEF5920000-0x000007FEF595F000-memory.dmp

    Filesize

    252KB

  • memory/1392-72-0x000007FEF6C50000-0x000007FEF6C71000-memory.dmp

    Filesize

    132KB

  • memory/1392-73-0x000007FEF5900000-0x000007FEF5918000-memory.dmp

    Filesize

    96KB

  • memory/1392-74-0x000007FEF58E0000-0x000007FEF58F1000-memory.dmp

    Filesize

    68KB

  • memory/1392-75-0x000007FEF58C0000-0x000007FEF58D1000-memory.dmp

    Filesize

    68KB

  • memory/1392-76-0x000007FEF58A0000-0x000007FEF58B1000-memory.dmp

    Filesize

    68KB

  • memory/1392-77-0x000007FEF5880000-0x000007FEF589B000-memory.dmp

    Filesize

    108KB

  • memory/1392-78-0x000007FEF5860000-0x000007FEF5871000-memory.dmp

    Filesize

    68KB

  • memory/1392-79-0x000007FEF5840000-0x000007FEF5858000-memory.dmp

    Filesize

    96KB

  • memory/1392-82-0x000007FEF5730000-0x000007FEF579F000-memory.dmp

    Filesize

    444KB

  • memory/1392-81-0x000007FEF57A0000-0x000007FEF5807000-memory.dmp

    Filesize

    412KB

  • memory/1392-80-0x000007FEF5810000-0x000007FEF5840000-memory.dmp

    Filesize

    192KB

  • memory/1392-83-0x000007FEF5710000-0x000007FEF5721000-memory.dmp

    Filesize

    68KB

  • memory/1392-84-0x000007FEF56B0000-0x000007FEF5706000-memory.dmp

    Filesize

    344KB

  • memory/1392-85-0x000007FEF5680000-0x000007FEF56A8000-memory.dmp

    Filesize

    160KB

  • memory/1392-86-0x000007FEF5650000-0x000007FEF5674000-memory.dmp

    Filesize

    144KB

  • memory/1392-87-0x000007FEF54D0000-0x000007FEF5648000-memory.dmp

    Filesize

    1.5MB

  • memory/1392-88-0x000007FEF54B0000-0x000007FEF54C7000-memory.dmp

    Filesize

    92KB

  • memory/1392-91-0x000007FEF5460000-0x000007FEF5471000-memory.dmp

    Filesize

    68KB

  • memory/1392-90-0x000007FEF5480000-0x000007FEF54AF000-memory.dmp

    Filesize

    188KB

  • memory/1392-89-0x000007FEF7C90000-0x000007FEF7CA0000-memory.dmp

    Filesize

    64KB

  • memory/1392-92-0x000007FEF5440000-0x000007FEF5456000-memory.dmp

    Filesize

    88KB

  • memory/1392-93-0x000007FEF5370000-0x000007FEF5435000-memory.dmp

    Filesize

    788KB

  • memory/1392-94-0x000007FEF52F0000-0x000007FEF5365000-memory.dmp

    Filesize

    468KB

  • memory/1392-95-0x000007FEF5280000-0x000007FEF52E2000-memory.dmp

    Filesize

    392KB

  • memory/1392-96-0x000007FEF5210000-0x000007FEF527D000-memory.dmp

    Filesize

    436KB

  • memory/1392-97-0x000007FEF51F0000-0x000007FEF5203000-memory.dmp

    Filesize

    76KB

  • memory/1392-98-0x000007FEF51D0000-0x000007FEF51E4000-memory.dmp

    Filesize

    80KB

  • memory/1392-99-0x000007FEF5180000-0x000007FEF51D0000-memory.dmp

    Filesize

    320KB

  • memory/1392-100-0x000007FEF50C0000-0x000007FEF517D000-memory.dmp

    Filesize

    756KB

  • memory/1392-101-0x000007FEF5090000-0x000007FEF50C0000-memory.dmp

    Filesize

    192KB

  • memory/1392-102-0x000007FEF38E0000-0x000007FEF5090000-memory.dmp

    Filesize

    23.7MB

  • memory/1392-103-0x000007FEF3770000-0x000007FEF38E0000-memory.dmp

    Filesize

    1.4MB

  • memory/1392-104-0x000007FEF3750000-0x000007FEF3762000-memory.dmp

    Filesize

    72KB

  • memory/1392-105-0x000007FEF3700000-0x000007FEF3742000-memory.dmp

    Filesize

    264KB

  • memory/1392-106-0x000007FEF36B0000-0x000007FEF36FC000-memory.dmp

    Filesize

    304KB

  • memory/1392-107-0x000007FEF3540000-0x000007FEF36AB000-memory.dmp

    Filesize

    1.4MB

  • memory/1392-108-0x000007FEF34E0000-0x000007FEF3537000-memory.dmp

    Filesize

    348KB

  • memory/1392-109-0x000007FEF3290000-0x000007FEF34DB000-memory.dmp

    Filesize

    2.3MB

  • memory/1392-110-0x000007FEF2FF0000-0x000007FEF320D000-memory.dmp

    Filesize

    2.1MB

  • memory/1392-111-0x000007FEF3270000-0x000007FEF3285000-memory.dmp

    Filesize

    84KB

  • memory/1392-112-0x000007FEF3240000-0x000007FEF3263000-memory.dmp

    Filesize

    140KB

  • memory/1392-113-0x000007FEF3220000-0x000007FEF3233000-memory.dmp

    Filesize

    76KB

  • memory/1392-114-0x000007FEF2EF0000-0x000007FEF2FE4000-memory.dmp

    Filesize

    976KB

  • memory/1392-115-0x000007FEF2EC0000-0x000007FEF2EEA000-memory.dmp

    Filesize

    168KB

  • memory/1392-116-0x000007FEF2EA0000-0x000007FEF2EB3000-memory.dmp

    Filesize

    76KB

  • memory/1392-117-0x000007FEF2E80000-0x000007FEF2E9B000-memory.dmp

    Filesize

    108KB

  • memory/1392-118-0x000007FEF2E60000-0x000007FEF2E72000-memory.dmp

    Filesize

    72KB

  • memory/1392-119-0x000007FEF2E40000-0x000007FEF2E55000-memory.dmp

    Filesize

    84KB

  • memory/1392-120-0x000007FEF2E20000-0x000007FEF2E33000-memory.dmp

    Filesize

    76KB

  • memory/1392-121-0x000007FEF2E00000-0x000007FEF2E14000-memory.dmp

    Filesize

    80KB

  • memory/1392-122-0x000007FEF2DE0000-0x000007FEF2DF2000-memory.dmp

    Filesize

    72KB