Analysis
-
max time kernel
141s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
01-04-2023 14:05
Static task
static1
Behavioral task
behavioral1
Sample
au_uu_SzH34yR2.mp3
Resource
win7-20230220-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
au_uu_SzH34yR2.mp3
Resource
win10v2004-20230220-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
au_uu_SzH34yR2.mp3
-
Size
1KB
-
MD5
965094dad28823f4dd46e49663b3f827
-
SHA1
f6388d91f745fb3bcd232058fc39ae4fad473c24
-
SHA256
817d0f138ec2042ed3a3583af1064bf4d9f48a60878dfa29701c397fc4e5549f
-
SHA512
38a4c6634154b234728fa4adc95c633c95809b80a2815ef9246a0197b722ed0c6ff638e8aa58382ad4ae66c3264a0b052c9dc58418f701b34c2128018f44c15b
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1368 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1368 vlc.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: 33 560 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 560 AUDIODG.EXE Token: 33 560 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 560 AUDIODG.EXE Token: 33 1368 vlc.exe Token: SeIncBasePriorityPrivilege 1368 vlc.exe -
Suspicious use of FindShellTrayWindow 15 IoCs
pid Process 1368 vlc.exe 1368 vlc.exe 1368 vlc.exe 1368 vlc.exe 1368 vlc.exe 1368 vlc.exe 1368 vlc.exe 1368 vlc.exe 1368 vlc.exe 1368 vlc.exe 1368 vlc.exe 1368 vlc.exe 1368 vlc.exe 1368 vlc.exe 1368 vlc.exe -
Suspicious use of SendNotifyMessage 14 IoCs
pid Process 1368 vlc.exe 1368 vlc.exe 1368 vlc.exe 1368 vlc.exe 1368 vlc.exe 1368 vlc.exe 1368 vlc.exe 1368 vlc.exe 1368 vlc.exe 1368 vlc.exe 1368 vlc.exe 1368 vlc.exe 1368 vlc.exe 1368 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1368 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\au_uu_SzH34yR2.mp3"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1368
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5841⤵
- Suspicious use of AdjustPrivilegeToken
PID:560