Analysis
-
max time kernel
1606s -
max time network
1610s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
05/05/2023, 01:07
Static task
static1
Behavioral task
behavioral1
Sample
8mb.video-3iG-Sdzu5zRe.mp4
Resource
win7-20230220-en
6 signatures
1800 seconds
Behavioral task
behavioral2
Sample
8mb.video-3iG-Sdzu5zRe.mp4
Resource
win10v2004-20230220-en
11 signatures
1800 seconds
General
-
Target
8mb.video-3iG-Sdzu5zRe.mp4
-
Size
6.6MB
-
MD5
14697f8363384f190e24bd14c1defa80
-
SHA1
4cb79cc946472723ceb76217ddf95dc8a3ac3a02
-
SHA256
45e323fb2b2f4b316ff9308ea94395146caedbf6b6cae64e1c72c0b9344b30bd
-
SHA512
49d8ac13178b46cb541937e43065133a07c0108c7029ad13693dc7a2ef45cf573c16e82e6ec4152bc044ead8dca7ba7eb12ed583d9afcabbf6ac11695e4ea5f7
-
SSDEEP
196608:f8JDxABRILZLyDpZLVHBnIzpMs1f0T/xOneByDM+Hh7zdATmv0:EJqBaQbLpxIl9fUOe6M+HhWTmc
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1256 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1256 vlc.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: 33 684 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 684 AUDIODG.EXE Token: 33 684 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 684 AUDIODG.EXE Token: 33 1256 vlc.exe Token: SeIncBasePriorityPrivilege 1256 vlc.exe -
Suspicious use of FindShellTrayWindow 32 IoCs
pid Process 1256 vlc.exe 1256 vlc.exe 1256 vlc.exe 1256 vlc.exe 1256 vlc.exe 1256 vlc.exe 1256 vlc.exe 1256 vlc.exe 1256 vlc.exe 1256 vlc.exe 1256 vlc.exe 1256 vlc.exe 1256 vlc.exe 1256 vlc.exe 1256 vlc.exe 1256 vlc.exe 1256 vlc.exe 1256 vlc.exe 1256 vlc.exe 1256 vlc.exe 1256 vlc.exe 1256 vlc.exe 1256 vlc.exe 1256 vlc.exe 1256 vlc.exe 1256 vlc.exe 1256 vlc.exe 1256 vlc.exe 1256 vlc.exe 1256 vlc.exe 1256 vlc.exe 1256 vlc.exe -
Suspicious use of SendNotifyMessage 10 IoCs
pid Process 1256 vlc.exe 1256 vlc.exe 1256 vlc.exe 1256 vlc.exe 1256 vlc.exe 1256 vlc.exe 1256 vlc.exe 1256 vlc.exe 1256 vlc.exe 1256 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1256 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\8mb.video-3iG-Sdzu5zRe.mp4"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1256
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0xc41⤵
- Suspicious use of AdjustPrivilegeToken
PID:684