Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system -
submitted
13/11/2023, 17:57
Static task
static1
Behavioral task
behavioral1
Sample
tomp3.cc - Hmm oh nice computer you got here_1080pFHR.mp4
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
tomp3.cc - Hmm oh nice computer you got here_1080pFHR.mp4
Resource
win10v2004-20231023-en
General
-
Target
tomp3.cc - Hmm oh nice computer you got here_1080pFHR.mp4
-
Size
3.2MB
-
MD5
4a8380ceffd2120e2e5f31f877714d89
-
SHA1
9cfc8e54d209aadf7de7e4667a16f7967002aa4c
-
SHA256
f271232e4fac512a4b6a0d29f62857e98a7a26edb68971e9d8a0997a8751a024
-
SHA512
0b94451e8f30d17027947d90e8a668a381cb47959262b369e97501b1ff720ffc5c932b03ebe56b85a7f1cabfb12952dbf7fd90a09c05b09dc98381d5ca578b57
-
SSDEEP
98304:WDGZNXWE6apHj9Q3IaWdRRLUz9XDmQY0Mz2:rWUpHAIndvLUzVHPMi
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2612 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2612 vlc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 2612 vlc.exe Token: SeIncBasePriorityPrivilege 2612 vlc.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
pid Process 2612 vlc.exe 2612 vlc.exe 2612 vlc.exe 2612 vlc.exe 2612 vlc.exe 2612 vlc.exe 2612 vlc.exe 2612 vlc.exe 2612 vlc.exe 2612 vlc.exe 2612 vlc.exe 2612 vlc.exe 2612 vlc.exe 2612 vlc.exe 2612 vlc.exe 2612 vlc.exe 2612 vlc.exe 2612 vlc.exe 2612 vlc.exe 2612 vlc.exe 2612 vlc.exe 2612 vlc.exe 2612 vlc.exe 2612 vlc.exe 2612 vlc.exe 2612 vlc.exe 2612 vlc.exe 2612 vlc.exe -
Suspicious use of SendNotifyMessage 9 IoCs
pid Process 2612 vlc.exe 2612 vlc.exe 2612 vlc.exe 2612 vlc.exe 2612 vlc.exe 2612 vlc.exe 2612 vlc.exe 2612 vlc.exe 2612 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2612 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\tomp3.cc - Hmm oh nice computer you got here_1080pFHR.mp4"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2612