Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
1Clip Studi....0.rar
windows7-x64
3Clip Studi....0.rar
windows10-2004-x64
3Clip Studi....0.rar
windows7-x64
3Clip Studi....0.rar
windows10-2004-x64
3Clip Studi...nt.exe
windows7-x64
1Clip Studi...nt.exe
windows10-2004-x64
1Clip Studi...up.exe
windows7-x64
7Clip Studi...up.exe
windows10-2004-x64
7Clip Studi...me.txt
windows7-x64
1Clip Studi...me.txt
windows10-2004-x64
1Clip Studi...RE.mp4
windows7-x64
1Clip Studi...RE.mp4
windows10-2004-x64
6Analysis
-
max time kernel
143s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
15/04/2023, 13:26
Static task
static1
Behavioral task
behavioral1
Sample
Clip Studio Paint EX v2.0.0.rar
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Clip Studio Paint EX v2.0.0.rar
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
Clip Studio Paint EX v2.0.0/Clip Studio Paint EX v2.0.0.rar
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
Clip Studio Paint EX v2.0.0/Clip Studio Paint EX v2.0.0.rar
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
Clip Studio Paint EX v2.0.0/CRACK/CLIPStudioPaint.exe
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
Clip Studio Paint EX v2.0.0/CRACK/CLIPStudioPaint.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
Clip Studio Paint EX v2.0.0/CSP_200w_setup.exe
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
Clip Studio Paint EX v2.0.0/CSP_200w_setup.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
Clip Studio Paint EX v2.0.0/Readme.txt
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
Clip Studio Paint EX v2.0.0/Readme.txt
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
Clip Studio Paint EX v2.0.0/PASSWORD HERE.mp4
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
Clip Studio Paint EX v2.0.0/PASSWORD HERE.mp4
Resource
win10v2004-20230220-en
General
-
Target
Clip Studio Paint EX v2.0.0/PASSWORD HERE.mp4
-
Size
8.7MB
-
MD5
dbf77071bb0b7a6f674b3e62c2044c82
-
SHA1
32b81afabca850d3645f3d2737a1d7c5e8822155
-
SHA256
e7b60036345e870b6e5b57cb3aabb0d5c0bc7f9fd49ff020b94e9da6eb4c94f4
-
SHA512
bbc3f954bb9abe76245ab445a6619dcd01a80fae58653d15ef4e653853ce582a6e0164a4d4caf53a029b2a7be6d44c88d14b16b671bc4e182a7dfdcadd07b840
-
SSDEEP
196608:0hw9qaE531OCl5M5d7EQ0Z8Cq3FpmzZFCbXqcUd1LfHRj76A:0iG31OCloYQYXqFYtFCXULLp6A
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1980 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1980 vlc.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: 33 1704 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1704 AUDIODG.EXE Token: 33 1704 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1704 AUDIODG.EXE Token: 33 1980 vlc.exe Token: SeIncBasePriorityPrivilege 1980 vlc.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 1980 vlc.exe 1980 vlc.exe 1980 vlc.exe 1980 vlc.exe 1980 vlc.exe 1980 vlc.exe 1980 vlc.exe 1980 vlc.exe 1980 vlc.exe 1980 vlc.exe 1980 vlc.exe 1980 vlc.exe 1980 vlc.exe 1980 vlc.exe 1980 vlc.exe 1980 vlc.exe 1980 vlc.exe 1980 vlc.exe 1980 vlc.exe 1980 vlc.exe 1980 vlc.exe 1980 vlc.exe 1980 vlc.exe 1980 vlc.exe 1980 vlc.exe 1980 vlc.exe 1980 vlc.exe -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 1980 vlc.exe 1980 vlc.exe 1980 vlc.exe 1980 vlc.exe 1980 vlc.exe 1980 vlc.exe 1980 vlc.exe 1980 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1980 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Clip Studio Paint EX v2.0.0\PASSWORD HERE.mp4"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1980
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5581⤵
- Suspicious use of AdjustPrivilegeToken
PID:1704