Analysis
-
max time kernel
142s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
31/08/2023, 06:01
Static task
static1
Behavioral task
behavioral1
Sample
paraelgrupo124.rar
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
paraelgrupo124.rar
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
ParaElGrupo124.mp4
Resource
win7-20230712-en
Behavioral task
behavioral4
Sample
ParaElGrupo124.mp4
Resource
win10v2004-20230703-en
General
-
Target
ParaElGrupo124.mp4
-
Size
2.5MB
-
MD5
fa55813c00056c302f4baccc33893a08
-
SHA1
d75f921d629a3cac1d9c671f91dea096e4e15f84
-
SHA256
80b3c9d26a278f66a4b2b582ff4ac3d40af57681e7533e20f0364aac4f8b265a
-
SHA512
15deeceea13b3b5053c5faaf57782138d24b521349627977c9e3590d476ed5e45f7e810c582abc21b96586f726b838d559daa3a48555efd5e3ecf8d9b9eff8d3
-
SSDEEP
49152:lZGNX87FnbhYIxQbwqdzm4AA9l5HiuS6zm89oaHf5sn9zp4IN7AX:lM+hY/bxdntHYh8HBs9zpP7AX
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2672 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2672 vlc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 2672 vlc.exe Token: SeIncBasePriorityPrivilege 2672 vlc.exe -
Suspicious use of FindShellTrayWindow 30 IoCs
pid Process 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2672 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\ParaElGrupo124.mp4"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2672