Analysis
-
max time kernel
14s -
max time network
25s -
platform
windows10-1703_x64 -
resource
win10-20240214-en -
resource tags
arch:x64arch:x86image:win10-20240214-enlocale:en-usos:windows10-1703-x64system -
submitted
19/02/2024, 21:31
Static task
static1
Behavioral task
behavioral1
Sample
TheWall.mp3
Resource
win10-20240214-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
TheWall.mp3
Resource
win10-20240214-en
3 signatures
150 seconds
General
-
Target
TheWall.mp3
-
Size
640KB
-
MD5
a1eb28c503e2e1509476aedcfa5348e0
-
SHA1
801510944567f5e9c8efaa00c6c3919c2d40d51d
-
SHA256
7136503dca5df99dcde9beed37baa9cf9fbb8d1564e0721efa2c8e78e693efaa
-
SHA512
cd956af67fc3ab5e1a544cee4cac502a886c1a99332b1a29861eed205359efdded3fe5f73666b6ad9fcd2373f85ba23277c9e358b4f2e8188e2094fc3d65480b
-
SSDEEP
12288:aQhrX0TBWB2cCfbV/O7XBsu4Vla9gmsjJ6YiUSdRn2C75vEa/p3tu:BhCc4Qz12aTlUSdRn2C7dJ7u
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 224 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 224 vlc.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 2220 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2220 AUDIODG.EXE Token: 33 224 vlc.exe Token: SeIncBasePriorityPrivilege 224 vlc.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 224 vlc.exe 224 vlc.exe 224 vlc.exe 224 vlc.exe 224 vlc.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 224 vlc.exe 224 vlc.exe 224 vlc.exe 224 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 224 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\TheWall.mp3"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:224
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2bc1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2220