Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
37s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
22/05/2023, 19:08
Static task
static1
Behavioral task
behavioral1
Sample
audio.mp3
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
audio.mp3
Resource
win10v2004-20230220-en
General
-
Target
audio.mp3
-
Size
205KB
-
MD5
1af60121c162f0a2a83c578069e7478a
-
SHA1
6c76601127ec87d45c75f7ab95ccf0f6a5b0f496
-
SHA256
9f56bd24998c7293eecc3e61e8f163d652915f42aad381a6eb7cd46fd41fb5a6
-
SHA512
905e6f3e3ee9b898f4b29032856302a78be84133c104ac02c0c962ee70ffffa90cd46a0648b0585d8ebc22157e98705923c132791ba2503cd4cb9e792fc1a24e
-
SSDEEP
3072:uwOM4tlS0JDZEBYHnGrhP0w5AxTs68XaOHrQz/a6+tPyadpXVYy:TOPRDZfGtP02A5sTKli6+tPp8y
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 924 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 924 vlc.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: 33 1116 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1116 AUDIODG.EXE Token: 33 1116 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1116 AUDIODG.EXE Token: 33 924 vlc.exe Token: SeIncBasePriorityPrivilege 924 vlc.exe -
Suspicious use of FindShellTrayWindow 12 IoCs
pid Process 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe -
Suspicious use of SendNotifyMessage 11 IoCs
pid Process 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe 924 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 924 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\audio.mp3"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:924
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x13c1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1116
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
93KB
MD5478a4a09f4f74e97335cd4d5e9da7ab5
SHA13c4f1dc52a293f079095d0b0370428ec8e8f9315
SHA256884b59950669842f3c45e6da3480cd9a553538b951fb155b435b48ff38683974
SHA512e96719663cd264132a8e1ea8c3f8a148c778a0c68caa2468ba47629393605b197dd9e00efad91f389de9fcc77b04981a0cf87f785f3c645cdc9e4ebd98060ca1