Analysis

  • max time kernel
    58s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    23/02/2024, 16:22

General

  • Target

    screen-capture.webm

  • Size

    5.8MB

  • MD5

    e8501f118687bbf33d042100d8b571ea

  • SHA1

    44d2a0084cb71440aeeb9b4021bb22501f05070b

  • SHA256

    8285c83067e9b3f33073a4f8e164aea69aa5ad54bde282f589f9ce568ffd9800

  • SHA512

    d8d5d3d8c5b3fd02815407bd74d2d97c591503f2c8fdccd87025f0e8b7ada9149726a2330de1add2dd3d3ca11fd601a5fc206d1d2ab512bc04e381b98d005a36

  • SSDEEP

    98304:N2KewtrWBtzhtuaelJWCDhHZFZGnFLnrlAaN/rZxF8RyU3GTTWJWhZ8nJXRdTpzN:NPIg/9QnNhAaR3ao/vIWhZ8J/T9w4Awd

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 23 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\screen-capture.webm"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:1244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1244-6-0x000007FEF78D0000-0x000007FEF7904000-memory.dmp

    Filesize

    208KB

  • memory/1244-14-0x000007FEF6D30000-0x000007FEF6D41000-memory.dmp

    Filesize

    68KB

  • memory/1244-13-0x000007FEF6D50000-0x000007FEF6D6D000-memory.dmp

    Filesize

    116KB

  • memory/1244-12-0x000007FEF6D70000-0x000007FEF6D81000-memory.dmp

    Filesize

    68KB

  • memory/1244-11-0x000007FEF7890000-0x000007FEF78A7000-memory.dmp

    Filesize

    92KB

  • memory/1244-23-0x000007FEF6740000-0x000007FEF675B000-memory.dmp

    Filesize

    108KB

  • memory/1244-29-0x000007FEF66B0000-0x000007FEF66C1000-memory.dmp

    Filesize

    68KB

  • memory/1244-35-0x000007FEF4BC0000-0x000007FEF4BD1000-memory.dmp

    Filesize

    68KB

  • memory/1244-42-0x000007FEF4800000-0x000007FEF49B2000-memory.dmp

    Filesize

    1.7MB

  • memory/1244-46-0x000007FEF44D0000-0x000007FEF44E2000-memory.dmp

    Filesize

    72KB

  • memory/1244-48-0x000007FEF4430000-0x000007FEF447C000-memory.dmp

    Filesize

    304KB

  • memory/1244-50-0x000007FEF4260000-0x000007FEF42B7000-memory.dmp

    Filesize

    348KB

  • memory/1244-51-0x000007FEF4010000-0x000007FEF425B000-memory.dmp

    Filesize

    2.3MB

  • memory/1244-49-0x000007FEF42C0000-0x000007FEF442B000-memory.dmp

    Filesize

    1.4MB

  • memory/1244-47-0x000007FEF4480000-0x000007FEF44C2000-memory.dmp

    Filesize

    264KB

  • memory/1244-54-0x000007FEF2830000-0x000007FEF285F000-memory.dmp

    Filesize

    188KB

  • memory/1244-62-0x000007FEF23D0000-0x000007FEF23E5000-memory.dmp

    Filesize

    84KB

  • memory/1244-68-0x000007FEF20A0000-0x000007FEF221A000-memory.dmp

    Filesize

    1.5MB

  • memory/1244-67-0x000007FEF2220000-0x000007FEF2232000-memory.dmp

    Filesize

    72KB

  • memory/1244-66-0x000007FEF2240000-0x000007FEF2251000-memory.dmp

    Filesize

    68KB

  • memory/1244-65-0x000007FEF2260000-0x000007FEF2354000-memory.dmp

    Filesize

    976KB

  • memory/1244-64-0x000007FEF2360000-0x000007FEF2373000-memory.dmp

    Filesize

    76KB

  • memory/1244-63-0x000007FEF23A0000-0x000007FEF23C3000-memory.dmp

    Filesize

    140KB

  • memory/1244-61-0x000007FEF23F0000-0x000007FEF260D000-memory.dmp

    Filesize

    2.1MB

  • memory/1244-60-0x000007FEF2610000-0x000007FEF2625000-memory.dmp

    Filesize

    84KB

  • memory/1244-59-0x000007FEF2630000-0x000007FEF2692000-memory.dmp

    Filesize

    392KB

  • memory/1244-58-0x000007FEF26A0000-0x000007FEF2715000-memory.dmp

    Filesize

    468KB

  • memory/1244-57-0x000007FEF2720000-0x000007FEF27E5000-memory.dmp

    Filesize

    788KB

  • memory/1244-56-0x000007FEF27F0000-0x000007FEF2806000-memory.dmp

    Filesize

    88KB

  • memory/1244-55-0x000007FEF2810000-0x000007FEF2821000-memory.dmp

    Filesize

    68KB

  • memory/1244-53-0x000007FEF7930000-0x000007FEF7940000-memory.dmp

    Filesize

    64KB

  • memory/1244-52-0x000007FEF2860000-0x000007FEF4010000-memory.dmp

    Filesize

    23.7MB

  • memory/1244-45-0x000007FEF44F0000-0x000007FEF4660000-memory.dmp

    Filesize

    1.4MB

  • memory/1244-44-0x000007FEF4660000-0x000007FEF4677000-memory.dmp

    Filesize

    92KB

  • memory/1244-43-0x000007FEF4680000-0x000007FEF47F8000-memory.dmp

    Filesize

    1.5MB

  • memory/1244-41-0x000007FEF49C0000-0x000007FEF49EC000-memory.dmp

    Filesize

    176KB

  • memory/1244-40-0x000007FEF49F0000-0x000007FEF4B2B000-memory.dmp

    Filesize

    1.2MB

  • memory/1244-39-0x000007FEF4B30000-0x000007FEF4B42000-memory.dmp

    Filesize

    72KB

  • memory/1244-38-0x000007FEF4B50000-0x000007FEF4B63000-memory.dmp

    Filesize

    76KB

  • memory/1244-37-0x000007FEF4B70000-0x000007FEF4B91000-memory.dmp

    Filesize

    132KB

  • memory/1244-36-0x000007FEF4BA0000-0x000007FEF4BB2000-memory.dmp

    Filesize

    72KB

  • memory/1244-34-0x000007FEF4BE0000-0x000007FEF4C03000-memory.dmp

    Filesize

    140KB

  • memory/1244-33-0x000007FEF4C10000-0x000007FEF4C27000-memory.dmp

    Filesize

    92KB

  • memory/1244-32-0x000007FEF4C30000-0x000007FEF4C54000-memory.dmp

    Filesize

    144KB

  • memory/1244-31-0x000007FEF4C60000-0x000007FEF4C88000-memory.dmp

    Filesize

    160KB

  • memory/1244-30-0x000007FEF4C90000-0x000007FEF4CE6000-memory.dmp

    Filesize

    344KB

  • memory/1244-28-0x000007FEF4CF0000-0x000007FEF4D5F000-memory.dmp

    Filesize

    444KB

  • memory/1244-27-0x000007FEF4D60000-0x000007FEF4DC7000-memory.dmp

    Filesize

    412KB

  • memory/1244-26-0x000007FEF66D0000-0x000007FEF6700000-memory.dmp

    Filesize

    192KB

  • memory/1244-25-0x000007FEF6700000-0x000007FEF6718000-memory.dmp

    Filesize

    96KB

  • memory/1244-24-0x000007FEF6720000-0x000007FEF6731000-memory.dmp

    Filesize

    68KB

  • memory/1244-22-0x000007FEF6760000-0x000007FEF6771000-memory.dmp

    Filesize

    68KB

  • memory/1244-21-0x000007FEF6780000-0x000007FEF6791000-memory.dmp

    Filesize

    68KB

  • memory/1244-20-0x000007FEF67A0000-0x000007FEF67B1000-memory.dmp

    Filesize

    68KB

  • memory/1244-19-0x000007FEF6880000-0x000007FEF6898000-memory.dmp

    Filesize

    96KB

  • memory/1244-18-0x000007FEF6D00000-0x000007FEF6D21000-memory.dmp

    Filesize

    132KB

  • memory/1244-17-0x000007FEF68A0000-0x000007FEF68DF000-memory.dmp

    Filesize

    252KB

  • memory/1244-16-0x000007FEF4DD0000-0x000007FEF4FD0000-memory.dmp

    Filesize

    2.0MB

  • memory/1244-15-0x000007FEF4FD0000-0x000007FEF607B000-memory.dmp

    Filesize

    16.7MB

  • memory/1244-10-0x000007FEF7940000-0x000007FEF7951000-memory.dmp

    Filesize

    68KB

  • memory/1244-9-0x000007FEFB290000-0x000007FEFB2A7000-memory.dmp

    Filesize

    92KB

  • memory/1244-8-0x000007FEFB820000-0x000007FEFB838000-memory.dmp

    Filesize

    96KB

  • memory/1244-7-0x000007FEF6080000-0x000007FEF6334000-memory.dmp

    Filesize

    2.7MB

  • memory/1244-5-0x000000013F170000-0x000000013F268000-memory.dmp

    Filesize

    992KB