Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
07/05/2023, 22:36
Static task
static1
Behavioral task
behavioral1
Sample
hd-acceleracers-with-battle-force-5-theme-song.mp4
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
hd-acceleracers-with-battle-force-5-theme-song.mp4
Resource
win10v2004-20230220-en
General
-
Target
hd-acceleracers-with-battle-force-5-theme-song.mp4
-
Size
17.7MB
-
MD5
76ae30e1ddc27325d7e516ef789ca1af
-
SHA1
f4474d21f24caf606af6a6c52c5741868abcff82
-
SHA256
dc9eccc04bfb90e12ae05a2ed6d50707a1182f20b23f581eabf03d47c8e98db1
-
SHA512
99cc89bf4fc65c16efe352fecbae9c60c1f46abe3ab159ada2096cfcd00989fd3699ce15c1c6c7ee91086db77324bca021c2223797293aa57f95d2da4cd59ae5
-
SSDEEP
393216:/OWILMh4hyHvfazQorx8fjSqbys0nY31o9kwck9i3bWqfEKV1r:2WgM6Zrxy5ysQY31om9Frbf3
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2020 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2020 vlc.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: 33 1440 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1440 AUDIODG.EXE Token: 33 1440 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1440 AUDIODG.EXE Token: 33 2020 vlc.exe Token: SeIncBasePriorityPrivilege 2020 vlc.exe -
Suspicious use of FindShellTrayWindow 23 IoCs
pid Process 2020 vlc.exe 2020 vlc.exe 2020 vlc.exe 2020 vlc.exe 2020 vlc.exe 2020 vlc.exe 2020 vlc.exe 2020 vlc.exe 2020 vlc.exe 2020 vlc.exe 2020 vlc.exe 2020 vlc.exe 2020 vlc.exe 2020 vlc.exe 2020 vlc.exe 2020 vlc.exe 2020 vlc.exe 2020 vlc.exe 2020 vlc.exe 2020 vlc.exe 2020 vlc.exe 2020 vlc.exe 2020 vlc.exe -
Suspicious use of SendNotifyMessage 5 IoCs
pid Process 2020 vlc.exe 2020 vlc.exe 2020 vlc.exe 2020 vlc.exe 2020 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2020 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\hd-acceleracers-with-battle-force-5-theme-song.mp4"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2020
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5641⤵
- Suspicious use of AdjustPrivilegeToken
PID:1440