Analysis
-
max time kernel
58s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23/02/2024, 16:22
Static task
static1
Behavioral task
behavioral1
Sample
screen-capture.webm
Resource
win7-20240221-en
6 signatures
60 seconds
Behavioral task
behavioral2
Sample
screen-capture.webm
Resource
win10v2004-20240221-en
10 signatures
60 seconds
General
-
Target
screen-capture.webm
-
Size
5.8MB
-
MD5
e8501f118687bbf33d042100d8b571ea
-
SHA1
44d2a0084cb71440aeeb9b4021bb22501f05070b
-
SHA256
8285c83067e9b3f33073a4f8e164aea69aa5ad54bde282f589f9ce568ffd9800
-
SHA512
d8d5d3d8c5b3fd02815407bd74d2d97c591503f2c8fdccd87025f0e8b7ada9149726a2330de1add2dd3d3ca11fd601a5fc206d1d2ab512bc04e381b98d005a36
-
SSDEEP
98304:N2KewtrWBtzhtuaelJWCDhHZFZGnFLnrlAaN/rZxF8RyU3GTTWJWhZ8nJXRdTpzN:NPIg/9QnNhAaR3ao/vIWhZ8J/T9w4Awd
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1244 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1244 vlc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 1244 vlc.exe Token: SeIncBasePriorityPrivilege 1244 vlc.exe -
Suspicious use of FindShellTrayWindow 23 IoCs
pid Process 1244 vlc.exe 1244 vlc.exe 1244 vlc.exe 1244 vlc.exe 1244 vlc.exe 1244 vlc.exe 1244 vlc.exe 1244 vlc.exe 1244 vlc.exe 1244 vlc.exe 1244 vlc.exe 1244 vlc.exe 1244 vlc.exe 1244 vlc.exe 1244 vlc.exe 1244 vlc.exe 1244 vlc.exe 1244 vlc.exe 1244 vlc.exe 1244 vlc.exe 1244 vlc.exe 1244 vlc.exe 1244 vlc.exe -
Suspicious use of SendNotifyMessage 5 IoCs
pid Process 1244 vlc.exe 1244 vlc.exe 1244 vlc.exe 1244 vlc.exe 1244 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1244 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\screen-capture.webm"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1244