Analysis
-
max time kernel
1600s -
max time network
1617s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
03-04-2023 20:05
Static task
static1
Behavioral task
behavioral1
Sample
0-02-0a-ab608ce4619c10c5d404f16bc3f3a3e1a39bcad96df6f2ffe440a46a09b7a566_d59198ec.mp4
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
0-02-0a-ab608ce4619c10c5d404f16bc3f3a3e1a39bcad96df6f2ffe440a46a09b7a566_d59198ec.mp4
Resource
win7-20230220-en
Behavioral task
behavioral3
Sample
0-02-0a-ab608ce4619c10c5d404f16bc3f3a3e1a39bcad96df6f2ffe440a46a09b7a566_d59198ec.mp4
Resource
win10v2004-20230221-en
General
-
Target
0-02-0a-ab608ce4619c10c5d404f16bc3f3a3e1a39bcad96df6f2ffe440a46a09b7a566_d59198ec.mp4
-
Size
9.0MB
-
MD5
2011df51a30664ddf718843763d9d418
-
SHA1
d8e74638ef0cac0b417c3e5870d27e1679ed2c75
-
SHA256
f5b3db14850a6a7622acb969eb356953a038d0547a2f96d1d5400f7e765eaecb
-
SHA512
125d40319b1d06e9d92cf67696bd6f7c0d60fc626198f01791b1f928b6f8055adfa4c5df2c87539ada4e9157be6abc389e01b8a1446bc90510535f56ebfe2003
-
SSDEEP
196608:swV7flhfeTswLYNX9b5TguVq075HIl3oG1n+2KWBAAZRmjOeP:9vlzkYTbiP0RWz1n+2KWBAAZRaOe
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1712 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1712 vlc.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: 33 988 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 988 AUDIODG.EXE Token: 33 988 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 988 AUDIODG.EXE Token: 33 1712 vlc.exe Token: SeIncBasePriorityPrivilege 1712 vlc.exe -
Suspicious use of FindShellTrayWindow 31 IoCs
pid Process 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe -
Suspicious use of SendNotifyMessage 9 IoCs
pid Process 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1712 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\0-02-0a-ab608ce4619c10c5d404f16bc3f3a3e1a39bcad96df6f2ffe440a46a09b7a566_d59198ec.mp4"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1712
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5741⤵
- Suspicious use of AdjustPrivilegeToken
PID:988