Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
16s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
01/09/2023, 19:13 UTC
Static task
static1
Behavioral task
behavioral1
Sample
drake speaks cayo perico.mp4
Resource
win7-20230831-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
drake speaks cayo perico.mp4
Resource
win10v2004-20230831-en
8 signatures
150 seconds
General
-
Target
drake speaks cayo perico.mp4
-
Size
1.4MB
-
MD5
af8e86342ee55b945ec4182f7e6f325f
-
SHA1
b47b32baac56cd827d4d7b85e33c0229873c256d
-
SHA256
a8c4d85e2fe586b100b12f351824299dd2925d1af3f18ecf7c4f7e7ed3f9ce4e
-
SHA512
eca2265d36429228cba13a70069fe965f5c9496c7678a5e44ac6fedc9567b2fd0f6482fbddd2606b1474e0324e844044081b6a56a875fe644a213e140969e9ee
-
SSDEEP
24576:RsSxf+QBCQtVFrhwhczVuQo+/iKVrpxHEuL3rsFL/16lKLP3MoLiLeRaU847PD:+Qfh8QtVJXtp/nA0y16lOPciEa7PD
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1692 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1692 vlc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 1692 vlc.exe Token: SeIncBasePriorityPrivilege 1692 vlc.exe -
Suspicious use of FindShellTrayWindow 31 IoCs
pid Process 1692 vlc.exe 1692 vlc.exe 1692 vlc.exe 1692 vlc.exe 1692 vlc.exe 1692 vlc.exe 1692 vlc.exe 1692 vlc.exe 1692 vlc.exe 1692 vlc.exe 1692 vlc.exe 1692 vlc.exe 1692 vlc.exe 1692 vlc.exe 1692 vlc.exe 1692 vlc.exe 1692 vlc.exe 1692 vlc.exe 1692 vlc.exe 1692 vlc.exe 1692 vlc.exe 1692 vlc.exe 1692 vlc.exe 1692 vlc.exe 1692 vlc.exe 1692 vlc.exe 1692 vlc.exe 1692 vlc.exe 1692 vlc.exe 1692 vlc.exe 1692 vlc.exe -
Suspicious use of SendNotifyMessage 9 IoCs
pid Process 1692 vlc.exe 1692 vlc.exe 1692 vlc.exe 1692 vlc.exe 1692 vlc.exe 1692 vlc.exe 1692 vlc.exe 1692 vlc.exe 1692 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1692 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\drake speaks cayo perico.mp4"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1692