Analysis
-
max time kernel
31s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20230220-es -
resource tags
arch:x64arch:x86image:win7-20230220-eslocale:es-esos:windows7-x64systemwindows -
submitted
10-06-2023 04:10
Static task
static1
Behavioral task
behavioral1
Sample
notscar.mov
Resource
win7-20230220-es
Behavioral task
behavioral2
Sample
notscar.mov
Resource
win10v2004-20230220-es
General
-
Target
notscar.mov
-
Size
88KB
-
MD5
56881dcdf0084a848edb50347d2d9a7f
-
SHA1
0f94cb36f076fa5976a78f366aa2839a300da9e7
-
SHA256
64dee6be9b52f4b0c1728baa228a6bc5f755cb6b667f0c1de814482b9f605c90
-
SHA512
80bfd36269bef691e0767bf253f3cffdd5513e43fc1c9dd4d8ee8e5ccdd18bcb14517a7d945f688f115ab179c1cd13f10a61f01b8a4ca42ccb6d295fbfb52f4b
-
SSDEEP
1536:n5JZEQpyBEhQUxwkYq6xLVP89cV/XsHyqI9r+XHmGeCiyFtdwoZPE5oh115OD51g:lDplFH6j80/XAIZ+XHrLFtNPd13ODXlm
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 728 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 728 vlc.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: 33 1776 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1776 AUDIODG.EXE Token: 33 1776 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1776 AUDIODG.EXE Token: 33 728 vlc.exe Token: SeIncBasePriorityPrivilege 728 vlc.exe -
Suspicious use of FindShellTrayWindow 10 IoCs
pid Process 728 vlc.exe 728 vlc.exe 728 vlc.exe 728 vlc.exe 728 vlc.exe 728 vlc.exe 728 vlc.exe 728 vlc.exe 728 vlc.exe 728 vlc.exe -
Suspicious use of SendNotifyMessage 9 IoCs
pid Process 728 vlc.exe 728 vlc.exe 728 vlc.exe 728 vlc.exe 728 vlc.exe 728 vlc.exe 728 vlc.exe 728 vlc.exe 728 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 728 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\notscar.mov"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:728
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4581⤵
- Suspicious use of AdjustPrivilegeToken
PID:1776
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
93KB
MD57d5ef2dffb8d0f8c5dfde20525d9e9ec
SHA1875f7115389c71f411249b9e619c6c3c76ad4972
SHA25697f54303096bd3b0925de62fff499ebcaf6b152a7a49a805491b249fc2723b1e
SHA512a37ad0ecb44b1d10293792bc9b6e79c9d507ccab608ba82576c7e27f6f167a0c122593a2dce5da79a5bb5d6deb5a80707873e69307e106a3632f925c7c0b8d39