Analysis
-
max time kernel
1600s -
max time network
1617s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
03-04-2023 20:05
Static task
static1
Behavioral task
behavioral1
Sample
0-02-0a-ab608ce4619c10c5d404f16bc3f3a3e1a39bcad96df6f2ffe440a46a09b7a566_d59198ec.mp4
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
0-02-0a-ab608ce4619c10c5d404f16bc3f3a3e1a39bcad96df6f2ffe440a46a09b7a566_d59198ec.mp4
Resource
win7-20230220-en
Behavioral task
behavioral3
Sample
0-02-0a-ab608ce4619c10c5d404f16bc3f3a3e1a39bcad96df6f2ffe440a46a09b7a566_d59198ec.mp4
Resource
win10v2004-20230221-en
General
-
Target
0-02-0a-ab608ce4619c10c5d404f16bc3f3a3e1a39bcad96df6f2ffe440a46a09b7a566_d59198ec.mp4
-
Size
9.0MB
-
MD5
2011df51a30664ddf718843763d9d418
-
SHA1
d8e74638ef0cac0b417c3e5870d27e1679ed2c75
-
SHA256
f5b3db14850a6a7622acb969eb356953a038d0547a2f96d1d5400f7e765eaecb
-
SHA512
125d40319b1d06e9d92cf67696bd6f7c0d60fc626198f01791b1f928b6f8055adfa4c5df2c87539ada4e9157be6abc389e01b8a1446bc90510535f56ebfe2003
-
SSDEEP
196608:swV7flhfeTswLYNX9b5TguVq075HIl3oG1n+2KWBAAZRmjOeP:9vlzkYTbiP0RWz1n+2KWBAAZRaOe
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
vlc.exepid process 1712 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
vlc.exepid process 1712 vlc.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
AUDIODG.EXEvlc.exedescription pid process Token: 33 988 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 988 AUDIODG.EXE Token: 33 988 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 988 AUDIODG.EXE Token: 33 1712 vlc.exe Token: SeIncBasePriorityPrivilege 1712 vlc.exe -
Suspicious use of FindShellTrayWindow 31 IoCs
Processes:
vlc.exepid process 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe -
Suspicious use of SendNotifyMessage 9 IoCs
Processes:
vlc.exepid process 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe 1712 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vlc.exepid process 1712 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\0-02-0a-ab608ce4619c10c5d404f16bc3f3a3e1a39bcad96df6f2ffe440a46a09b7a566_d59198ec.mp4"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5741⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1712-59-0x000000013FF80000-0x0000000140078000-memory.dmpFilesize
992KB
-
memory/1712-60-0x000007FEFAD10000-0x000007FEFAD44000-memory.dmpFilesize
208KB
-
memory/1712-61-0x000007FEF6BB0000-0x000007FEF6E64000-memory.dmpFilesize
2.7MB
-
memory/1712-62-0x000007FEFB9B0000-0x000007FEFB9C8000-memory.dmpFilesize
96KB
-
memory/1712-63-0x000007FEFACF0000-0x000007FEFAD07000-memory.dmpFilesize
92KB
-
memory/1712-64-0x000007FEFACD0000-0x000007FEFACE1000-memory.dmpFilesize
68KB
-
memory/1712-65-0x000007FEF7000000-0x000007FEF7017000-memory.dmpFilesize
92KB
-
memory/1712-66-0x000007FEF6FE0000-0x000007FEF6FF1000-memory.dmpFilesize
68KB
-
memory/1712-67-0x000007FEF6FC0000-0x000007FEF6FDD000-memory.dmpFilesize
116KB
-
memory/1712-68-0x000007FEF6FA0000-0x000007FEF6FB1000-memory.dmpFilesize
68KB
-
memory/1712-69-0x000007FEF6820000-0x000007FEF6A20000-memory.dmpFilesize
2.0MB
-
memory/1712-70-0x000007FEF5770000-0x000007FEF681B000-memory.dmpFilesize
16.7MB
-
memory/1712-71-0x000007FEF6B70000-0x000007FEF6BAF000-memory.dmpFilesize
252KB
-
memory/1712-72-0x000007FEF6B40000-0x000007FEF6B61000-memory.dmpFilesize
132KB
-
memory/1712-73-0x000007FEF6B20000-0x000007FEF6B38000-memory.dmpFilesize
96KB
-
memory/1712-74-0x000007FEF6B00000-0x000007FEF6B11000-memory.dmpFilesize
68KB
-
memory/1712-75-0x000007FEF6AA0000-0x000007FEF6AB1000-memory.dmpFilesize
68KB
-
memory/1712-76-0x000007FEF6A80000-0x000007FEF6A91000-memory.dmpFilesize
68KB
-
memory/1712-77-0x000007FEF6A60000-0x000007FEF6A7B000-memory.dmpFilesize
108KB
-
memory/1712-78-0x000007FEF6A40000-0x000007FEF6A51000-memory.dmpFilesize
68KB
-
memory/1712-79-0x000007FEF5750000-0x000007FEF5768000-memory.dmpFilesize
96KB
-
memory/1712-80-0x000007FEF5720000-0x000007FEF5750000-memory.dmpFilesize
192KB
-
memory/1712-81-0x000007FEF56B0000-0x000007FEF5717000-memory.dmpFilesize
412KB
-
memory/1712-82-0x000007FEF5640000-0x000007FEF56AF000-memory.dmpFilesize
444KB
-
memory/1712-83-0x000007FEF5620000-0x000007FEF5631000-memory.dmpFilesize
68KB
-
memory/1712-84-0x000007FEF55C0000-0x000007FEF5616000-memory.dmpFilesize
344KB
-
memory/1712-85-0x000007FEF5440000-0x000007FEF55B8000-memory.dmpFilesize
1.5MB
-
memory/1712-86-0x000007FEF5420000-0x000007FEF5437000-memory.dmpFilesize
92KB
-
memory/1712-87-0x000007FEF52B0000-0x000007FEF5420000-memory.dmpFilesize
1.4MB
-
memory/1712-88-0x000007FEF5290000-0x000007FEF52A2000-memory.dmpFilesize
72KB
-
memory/1712-89-0x000007FEF5240000-0x000007FEF5282000-memory.dmpFilesize
264KB
-
memory/1712-90-0x000007FEF51F0000-0x000007FEF523C000-memory.dmpFilesize
304KB
-
memory/1712-91-0x000007FEF5080000-0x000007FEF51EB000-memory.dmpFilesize
1.4MB
-
memory/1712-92-0x000007FEF5020000-0x000007FEF5077000-memory.dmpFilesize
348KB
-
memory/1712-93-0x000007FEF4DD0000-0x000007FEF501B000-memory.dmpFilesize
2.3MB
-
memory/1712-94-0x000007FEF3620000-0x000007FEF4DD0000-memory.dmpFilesize
23.7MB
-
memory/1712-95-0x000007FEF7B20000-0x000007FEF7B30000-memory.dmpFilesize
64KB
-
memory/1712-96-0x000007FEF35F0000-0x000007FEF361F000-memory.dmpFilesize
188KB
-
memory/1712-98-0x000007FEF35B0000-0x000007FEF35C6000-memory.dmpFilesize
88KB
-
memory/1712-97-0x000007FEF35D0000-0x000007FEF35E1000-memory.dmpFilesize
68KB
-
memory/1712-99-0x000007FEF34E0000-0x000007FEF35A5000-memory.dmpFilesize
788KB
-
memory/1712-100-0x000007FEF3460000-0x000007FEF34D5000-memory.dmpFilesize
468KB
-
memory/1712-101-0x000007FEF33F0000-0x000007FEF3452000-memory.dmpFilesize
392KB
-
memory/1712-102-0x000007FEF3380000-0x000007FEF33ED000-memory.dmpFilesize
436KB
-
memory/1712-103-0x000007FEF3360000-0x000007FEF3373000-memory.dmpFilesize
76KB
-
memory/1712-104-0x000007FEF3340000-0x000007FEF3354000-memory.dmpFilesize
80KB
-
memory/1712-105-0x000007FEF32F0000-0x000007FEF3340000-memory.dmpFilesize
320KB
-
memory/1712-106-0x000007FEF32D0000-0x000007FEF32E5000-memory.dmpFilesize
84KB
-
memory/1712-107-0x000007FEF30B0000-0x000007FEF32CD000-memory.dmpFilesize
2.1MB
-
memory/1712-108-0x000007FEF3090000-0x000007FEF30A5000-memory.dmpFilesize
84KB
-
memory/1712-109-0x000007FEF3060000-0x000007FEF3083000-memory.dmpFilesize
140KB
-
memory/1712-110-0x000007FEF3040000-0x000007FEF3053000-memory.dmpFilesize
76KB
-
memory/1712-111-0x000007FEF2F40000-0x000007FEF3034000-memory.dmpFilesize
976KB
-
memory/1712-112-0x000007FEF2F10000-0x000007FEF2F3A000-memory.dmpFilesize
168KB
-
memory/1712-113-0x000007FEF2EF0000-0x000007FEF2F03000-memory.dmpFilesize
76KB
-
memory/1712-114-0x000007FEF2ED0000-0x000007FEF2EEB000-memory.dmpFilesize
108KB
-
memory/1712-115-0x000007FEF2EB0000-0x000007FEF2EC2000-memory.dmpFilesize
72KB
-
memory/1712-116-0x000007FEF2E90000-0x000007FEF2EA5000-memory.dmpFilesize
84KB
-
memory/1712-117-0x000007FEF2E70000-0x000007FEF2E83000-memory.dmpFilesize
76KB
-
memory/1712-118-0x000007FEF2E50000-0x000007FEF2E64000-memory.dmpFilesize
80KB
-
memory/1712-119-0x000007FEF2E30000-0x000007FEF2E42000-memory.dmpFilesize
72KB
-
memory/1712-120-0x000007FEF2E10000-0x000007FEF2E25000-memory.dmpFilesize
84KB
-
memory/1712-121-0x000007FEF2DF0000-0x000007FEF2E05000-memory.dmpFilesize
84KB
-
memory/1712-122-0x000007FEF2DD0000-0x000007FEF2DE1000-memory.dmpFilesize
68KB