Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
398s -
max time network
401s -
platform
windows7_x64 -
resource
win7-20230621-es -
resource tags
arch:x64arch:x86image:win7-20230621-eslocale:es-esos:windows7-x64systemwindows -
submitted
29/06/2023, 05:04
Static task
static1
Behavioral task
behavioral1
Sample
Tiktok_video-1.mp4
Resource
win7-20230621-es
6 signatures
600 seconds
Behavioral task
behavioral2
Sample
Tiktok_video-1.mp4
Resource
win10v2004-20230621-es
9 signatures
600 seconds
General
-
Target
Tiktok_video-1.mp4
-
Size
695KB
-
MD5
69db621989058b35f1e055df8f31b9a7
-
SHA1
70d1dd38ee50469a775ef398d426d16bafeb2116
-
SHA256
9f5cffa8b530875eeca2df6da13fe208d184033bbce7e81a316365c8de009cbe
-
SHA512
7e9eeaa1dbe461dbf677c78582b5ca7c02bbb84a324341e24dc5b051f4314618089c8df34ff4ac7e000a9660c7c8c3ddd2c0bd12dc5959f78d554df9829e3470
-
SSDEEP
12288:qsK8N6eOTsuu10YmejS17vtbqXdm5Cv1qWQPzQNJX1QDOEeZ:q2ROT8100jS17VmXZvQzbQNJX13EeZ
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2036 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2036 vlc.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: 33 796 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 796 AUDIODG.EXE Token: 33 796 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 796 AUDIODG.EXE Token: 33 2036 vlc.exe Token: SeIncBasePriorityPrivilege 2036 vlc.exe -
Suspicious use of FindShellTrayWindow 42 IoCs
pid Process 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe 2036 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2036 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Tiktok_video-1.mp4"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2036
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5301⤵
- Suspicious use of AdjustPrivilegeToken
PID:796