Analysis

  • max time kernel
    31s
  • max time network
    35s
  • platform
    windows7_x64
  • resource
    win7-20230220-es
  • resource tags

    arch:x64arch:x86image:win7-20230220-eslocale:es-esos:windows7-x64systemwindows
  • submitted
    10-06-2023 04:10

General

  • Target

    notscar.mov

  • Size

    88KB

  • MD5

    56881dcdf0084a848edb50347d2d9a7f

  • SHA1

    0f94cb36f076fa5976a78f366aa2839a300da9e7

  • SHA256

    64dee6be9b52f4b0c1728baa228a6bc5f755cb6b667f0c1de814482b9f605c90

  • SHA512

    80bfd36269bef691e0767bf253f3cffdd5513e43fc1c9dd4d8ee8e5ccdd18bcb14517a7d945f688f115ab179c1cd13f10a61f01b8a4ca42ccb6d295fbfb52f4b

  • SSDEEP

    1536:n5JZEQpyBEhQUxwkYq6xLVP89cV/XsHyqI9r+XHmGeCiyFtdwoZPE5oh115OD51g:lDplFH6j80/XAIZ+XHrLFtNPd13ODXlm

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 10 IoCs
  • Suspicious use of SendNotifyMessage 9 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\notscar.mov"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:728
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x458
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\vlc\vlcrc.728

    Filesize

    93KB

    MD5

    7d5ef2dffb8d0f8c5dfde20525d9e9ec

    SHA1

    875f7115389c71f411249b9e619c6c3c76ad4972

    SHA256

    97f54303096bd3b0925de62fff499ebcaf6b152a7a49a805491b249fc2723b1e

    SHA512

    a37ad0ecb44b1d10293792bc9b6e79c9d507ccab608ba82576c7e27f6f167a0c122593a2dce5da79a5bb5d6deb5a80707873e69307e106a3632f925c7c0b8d39

  • memory/728-60-0x000007FEFAE00000-0x000007FEFAE34000-memory.dmp

    Filesize

    208KB

  • memory/728-59-0x000000013F0E0000-0x000000013F1D8000-memory.dmp

    Filesize

    992KB

  • memory/728-61-0x000007FEF64E0000-0x000007FEF6794000-memory.dmp

    Filesize

    2.7MB

  • memory/728-68-0x000007FEFA840000-0x000007FEFA851000-memory.dmp

    Filesize

    68KB

  • memory/728-69-0x000007FEF5DA0000-0x000007FEF5FA0000-memory.dmp

    Filesize

    2.0MB

  • memory/728-67-0x000007FEFA860000-0x000007FEFA87D000-memory.dmp

    Filesize

    116KB

  • memory/728-66-0x000007FEFA880000-0x000007FEFA891000-memory.dmp

    Filesize

    68KB

  • memory/728-65-0x000007FEFA8A0000-0x000007FEFA8B7000-memory.dmp

    Filesize

    92KB

  • memory/728-64-0x000007FEFADB0000-0x000007FEFADC1000-memory.dmp

    Filesize

    68KB

  • memory/728-63-0x000007FEFADD0000-0x000007FEFADE7000-memory.dmp

    Filesize

    92KB

  • memory/728-62-0x000007FEFB8B0000-0x000007FEFB8C8000-memory.dmp

    Filesize

    96KB

  • memory/728-71-0x000007FEFA800000-0x000007FEFA83F000-memory.dmp

    Filesize

    252KB

  • memory/728-72-0x000007FEFA7D0000-0x000007FEFA7F1000-memory.dmp

    Filesize

    132KB

  • memory/728-82-0x000007FEF62E0000-0x000007FEF634F000-memory.dmp

    Filesize

    444KB

  • memory/728-83-0x000007FEF62C0000-0x000007FEF62D1000-memory.dmp

    Filesize

    68KB

  • memory/728-81-0x000007FEF6350000-0x000007FEF63B7000-memory.dmp

    Filesize

    412KB

  • memory/728-84-0x000007FEF6050000-0x000007FEF60A6000-memory.dmp

    Filesize

    344KB

  • memory/728-80-0x000007FEF63C0000-0x000007FEF63F0000-memory.dmp

    Filesize

    192KB

  • memory/728-85-0x000007FEF4B70000-0x000007FEF4CE8000-memory.dmp

    Filesize

    1.5MB

  • memory/728-86-0x000007FEF6150000-0x000007FEF6167000-memory.dmp

    Filesize

    92KB

  • memory/728-87-0x000007FEFAAA0000-0x000007FEFAAB0000-memory.dmp

    Filesize

    64KB

  • memory/728-88-0x000007FEF6120000-0x000007FEF614F000-memory.dmp

    Filesize

    188KB

  • memory/728-89-0x000007FEF6030000-0x000007FEF6041000-memory.dmp

    Filesize

    68KB

  • memory/728-90-0x000007FEF6010000-0x000007FEF6026000-memory.dmp

    Filesize

    88KB

  • memory/728-79-0x000007FEF64A0000-0x000007FEF64B8000-memory.dmp

    Filesize

    96KB

  • memory/728-78-0x000007FEF64C0000-0x000007FEF64D1000-memory.dmp

    Filesize

    68KB

  • memory/728-77-0x000007FEF68D0000-0x000007FEF68EB000-memory.dmp

    Filesize

    108KB

  • memory/728-92-0x000007FEF4A20000-0x000007FEF4A95000-memory.dmp

    Filesize

    468KB

  • memory/728-93-0x000007FEF49B0000-0x000007FEF4A12000-memory.dmp

    Filesize

    392KB

  • memory/728-97-0x000007FEF48D0000-0x000007FEF4920000-memory.dmp

    Filesize

    320KB

  • memory/728-96-0x000007FEF4920000-0x000007FEF4934000-memory.dmp

    Filesize

    80KB

  • memory/728-101-0x000007FEF47E0000-0x000007FEF4810000-memory.dmp

    Filesize

    192KB

  • memory/728-98-0x000007FEF4810000-0x000007FEF48CD000-memory.dmp

    Filesize

    756KB

  • memory/728-95-0x000007FEF5FF0000-0x000007FEF6003000-memory.dmp

    Filesize

    76KB

  • memory/728-94-0x000007FEF4940000-0x000007FEF49AD000-memory.dmp

    Filesize

    436KB

  • memory/728-91-0x000007FEF4AA0000-0x000007FEF4B65000-memory.dmp

    Filesize

    788KB

  • memory/728-76-0x000007FEF68F0000-0x000007FEF6901000-memory.dmp

    Filesize

    68KB

  • memory/728-75-0x000007FEF6910000-0x000007FEF6921000-memory.dmp

    Filesize

    68KB

  • memory/728-74-0x000007FEF6930000-0x000007FEF6941000-memory.dmp

    Filesize

    68KB

  • memory/728-73-0x000007FEFA7B0000-0x000007FEFA7C8000-memory.dmp

    Filesize

    96KB

  • memory/728-70-0x000007FEF4CF0000-0x000007FEF5D9B000-memory.dmp

    Filesize

    16.7MB

  • memory/728-105-0x000007FEF2CB0000-0x000007FEF2CC2000-memory.dmp

    Filesize

    72KB

  • memory/728-111-0x000007FEF2A90000-0x000007FEF2AA1000-memory.dmp

    Filesize

    68KB

  • memory/728-112-0x000007FEF2A70000-0x000007FEF2A86000-memory.dmp

    Filesize

    88KB

  • memory/728-106-0x000007FEF2B30000-0x000007FEF2CAA000-memory.dmp

    Filesize

    1.5MB

  • memory/728-110-0x000007FEF2AB0000-0x000007FEF2AC1000-memory.dmp

    Filesize

    68KB

  • memory/728-109-0x000007FEF2AD0000-0x000007FEF2AE1000-memory.dmp

    Filesize

    68KB

  • memory/728-108-0x000007FEF2AF0000-0x000007FEF2B04000-memory.dmp

    Filesize

    80KB

  • memory/728-107-0x000007FEF2B10000-0x000007FEF2B23000-memory.dmp

    Filesize

    76KB

  • memory/728-102-0x000007FEF3030000-0x000007FEF47E0000-memory.dmp

    Filesize

    23.7MB

  • memory/728-104-0x000007FEF2CD0000-0x000007FEF2CE1000-memory.dmp

    Filesize

    68KB

  • memory/728-103-0x000007FEF3010000-0x000007FEF3025000-memory.dmp

    Filesize

    84KB

  • memory/728-115-0x000007FEF64E0000-0x000007FEF6794000-memory.dmp

    Filesize

    2.7MB

  • memory/728-124-0x000007FEF4CF0000-0x000007FEF5D9B000-memory.dmp

    Filesize

    16.7MB