Analysis
-
max time kernel
80s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
24/04/2023, 23:28
Static task
static1
Behavioral task
behavioral1
Sample
8067ba8a0569364709313ed9244182e3.mp4
Resource
win7-20230220-en
6 signatures
1800 seconds
General
-
Target
8067ba8a0569364709313ed9244182e3.mp4
-
Size
3.1MB
-
MD5
7941dc5069f9d8a68ae19bb02ac2d735
-
SHA1
0cf34a92beb7e05ff6da0811628b1b6fbe24eb9f
-
SHA256
17ead8ff12f579f57e100a2ea143fdb27891aa477139a22f34271940e28b4eaf
-
SHA512
43df269a01e03fe9bffa381946e1787c16e413d8eb37fa414b5ef18669683db2a04b1b9eb6326ef65f5d6c1b1f5eb9ad6f5b8dea3c90d74109f48bacb55ba3f3
-
SSDEEP
49152:TIMPrPUnDdBLvjDEESRZPBg6ZNHZERYkApmAvlJtYpXozVXpLhfAAfGBNl:TIMsnnvjDEdRAqlZa4LZxXpFAAfGPl
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1116 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1116 vlc.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: 33 1664 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1664 AUDIODG.EXE Token: 33 1664 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1664 AUDIODG.EXE Token: 33 1116 vlc.exe Token: SeIncBasePriorityPrivilege 1116 vlc.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
pid Process 1116 vlc.exe 1116 vlc.exe 1116 vlc.exe 1116 vlc.exe 1116 vlc.exe 1116 vlc.exe 1116 vlc.exe 1116 vlc.exe 1116 vlc.exe 1116 vlc.exe 1116 vlc.exe 1116 vlc.exe 1116 vlc.exe 1116 vlc.exe 1116 vlc.exe 1116 vlc.exe 1116 vlc.exe 1116 vlc.exe 1116 vlc.exe 1116 vlc.exe 1116 vlc.exe 1116 vlc.exe 1116 vlc.exe 1116 vlc.exe 1116 vlc.exe 1116 vlc.exe 1116 vlc.exe 1116 vlc.exe -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 1116 vlc.exe 1116 vlc.exe 1116 vlc.exe 1116 vlc.exe 1116 vlc.exe 1116 vlc.exe 1116 vlc.exe 1116 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1116 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\8067ba8a0569364709313ed9244182e3.mp4"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1116
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x51c1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1664