Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    19-06-2024 08:54

General

  • Target

    9375a86ba8682fe.mp3

  • Size

    500KB

  • MD5

    d5aa6db98c337e30c4c56ff3154d504d

  • SHA1

    eb8195a092370e5010a4e1703b0ba142c1e4d16c

  • SHA256

    a97b00ee3561353942fab71041e7e48d8b4da2a3ee51523d011541b6c8f45159

  • SHA512

    4a9c47214c1f74c7137f206c646f435228fc0480ec2aa687f9c9e17898f1ae0c834190a28d5f2e90c742b1d39d109275b25ae6e51c62414aef7d354123fad04c

  • SSDEEP

    12288:i8IRLEXuGx5k9ZwtCbobJVzpvy3JcpCMxjgUs1X6p2puGJ+:dIhyuctYoNVNv5CCnyqpAJ+

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 19 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\9375a86ba8682fe.mp3"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:1584
  • C:\Windows\system32\SndVol.exe
    SndVol.exe -f 46466202 14170
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2888
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
    1⤵
      PID:2352

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1584-5-0x000000013FF00000-0x000000013FFF8000-memory.dmp

      Filesize

      992KB

    • memory/1584-6-0x000007FEFAF10000-0x000007FEFAF44000-memory.dmp

      Filesize

      208KB

    • memory/1584-8-0x000007FEFB6E0000-0x000007FEFB6F8000-memory.dmp

      Filesize

      96KB

    • memory/1584-12-0x000007FEF7360000-0x000007FEF7371000-memory.dmp

      Filesize

      68KB

    • memory/1584-14-0x000007FEF6AC0000-0x000007FEF6AD1000-memory.dmp

      Filesize

      68KB

    • memory/1584-13-0x000007FEF7340000-0x000007FEF735D000-memory.dmp

      Filesize

      116KB

    • memory/1584-11-0x000007FEF7380000-0x000007FEF7397000-memory.dmp

      Filesize

      92KB

    • memory/1584-7-0x000007FEF61F0000-0x000007FEF64A4000-memory.dmp

      Filesize

      2.7MB

    • memory/1584-10-0x000007FEF8230000-0x000007FEF8241000-memory.dmp

      Filesize

      68KB

    • memory/1584-9-0x000007FEFB1F0000-0x000007FEFB207000-memory.dmp

      Filesize

      92KB

    • memory/1584-16-0x000007FEF4F40000-0x000007FEF5140000-memory.dmp

      Filesize

      2.0MB

    • memory/1584-18-0x000007FEF6A50000-0x000007FEF6A71000-memory.dmp

      Filesize

      132KB

    • memory/1584-19-0x000007FEF6A30000-0x000007FEF6A48000-memory.dmp

      Filesize

      96KB

    • memory/1584-20-0x000007FEF6A10000-0x000007FEF6A21000-memory.dmp

      Filesize

      68KB

    • memory/1584-21-0x000007FEF69F0000-0x000007FEF6A01000-memory.dmp

      Filesize

      68KB

    • memory/1584-17-0x000007FEF6A80000-0x000007FEF6ABF000-memory.dmp

      Filesize

      252KB

    • memory/1584-22-0x000007FEF69D0000-0x000007FEF69E1000-memory.dmp

      Filesize

      68KB

    • memory/1584-23-0x000007FEF6780000-0x000007FEF679B000-memory.dmp

      Filesize

      108KB

    • memory/1584-24-0x000007FEF6760000-0x000007FEF6771000-memory.dmp

      Filesize

      68KB

    • memory/1584-25-0x000007FEF6740000-0x000007FEF6758000-memory.dmp

      Filesize

      96KB

    • memory/1584-26-0x000007FEF6710000-0x000007FEF6740000-memory.dmp

      Filesize

      192KB

    • memory/1584-27-0x000007FEF66A0000-0x000007FEF6707000-memory.dmp

      Filesize

      412KB

    • memory/1584-28-0x000007FEF4ED0000-0x000007FEF4F3F000-memory.dmp

      Filesize

      444KB

    • memory/1584-29-0x000007FEF6620000-0x000007FEF6631000-memory.dmp

      Filesize

      68KB

    • memory/1584-30-0x000007FEF6600000-0x000007FEF6617000-memory.dmp

      Filesize

      92KB

    • memory/1584-31-0x000007FEF4EB0000-0x000007FEF4EC1000-memory.dmp

      Filesize

      68KB

    • memory/1584-32-0x000007FEF4E50000-0x000007FEF4EA7000-memory.dmp

      Filesize

      348KB

    • memory/1584-34-0x000007FEF4E00000-0x000007FEF4E13000-memory.dmp

      Filesize

      76KB

    • memory/1584-35-0x000007FEF4DE0000-0x000007FEF4DF1000-memory.dmp

      Filesize

      68KB

    • memory/1584-36-0x000007FEF4D10000-0x000007FEF4DD5000-memory.dmp

      Filesize

      788KB

    • memory/1584-33-0x000007FEF4E20000-0x000007FEF4E4F000-memory.dmp

      Filesize

      188KB

    • memory/1584-37-0x000007FEF3160000-0x000007FEF31B6000-memory.dmp

      Filesize

      344KB

    • memory/1584-38-0x000007FEF3130000-0x000007FEF3158000-memory.dmp

      Filesize

      160KB

    • memory/1584-39-0x000007FEF2F20000-0x000007FEF2F31000-memory.dmp

      Filesize

      68KB

    • memory/1584-40-0x000007FEF2F00000-0x000007FEF2F12000-memory.dmp

      Filesize

      72KB

    • memory/1584-46-0x000007FEF2CE0000-0x000007FEF2CF1000-memory.dmp

      Filesize

      68KB

    • memory/1584-45-0x000007FEF2D00000-0x000007FEF2D11000-memory.dmp

      Filesize

      68KB

    • memory/1584-44-0x000007FEF2D20000-0x000007FEF2D31000-memory.dmp

      Filesize

      68KB

    • memory/1584-43-0x000007FEF2D40000-0x000007FEF2D54000-memory.dmp

      Filesize

      80KB

    • memory/1584-15-0x000007FEF5140000-0x000007FEF61EB000-memory.dmp

      Filesize

      16.7MB

    • memory/1584-42-0x000007FEF2D60000-0x000007FEF2D73000-memory.dmp

      Filesize

      76KB

    • memory/1584-41-0x000007FEF2D80000-0x000007FEF2EFA000-memory.dmp

      Filesize

      1.5MB

    • memory/2888-306-0x00000000006B0000-0x00000000006B1000-memory.dmp

      Filesize

      4KB