Resubmissions
03-08-2024 14:36
240803-ryw8dswelq 1003-08-2024 14:34
240803-rxs5cawejl 603-08-2024 14:30
240803-rvcpkswdkr 6Analysis
-
max time kernel
21s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
03-08-2024 14:34
Static task
static1
Behavioral task
behavioral1
Sample
gothymilly76b779.mp4
Resource
win7-20240704-en
windows7-x64
6 signatures
30 seconds
Behavioral task
behavioral2
Sample
gothymilly76b779.mp4
Resource
win10v2004-20240802-en
windows10-2004-x64
8 signatures
30 seconds
General
-
Target
gothymilly76b779.mp4
-
Size
261KB
-
MD5
d3d13a4ac1f069c0c305836dca7a79f4
-
SHA1
9b3fdb93a1e59d3238b110bef6a56ddc4c94c449
-
SHA256
86c8812621c9af04b428b99aeb96627a340c3810d2bdb1053d2fb0357337a99e
-
SHA512
f3f8a5814fab743ab4f3f31f800ef66171673dbacbe66722e2a865cc97fc3e59deb2655da10e5ac84826d3fcb2c4ee0d671c7d0179a0b6e3ee850f43b348515f
-
SSDEEP
6144:lPL62UN2BRLvehowE4wFFrAuROLFgCRofacyfI5IhdgDJkihg8T0t+:d7A2DvehXwb0uRCg7fa9w5KCdV1b
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1848 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1848 vlc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 1848 vlc.exe Token: SeIncBasePriorityPrivilege 1848 vlc.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
pid Process 1848 vlc.exe 1848 vlc.exe 1848 vlc.exe 1848 vlc.exe 1848 vlc.exe 1848 vlc.exe 1848 vlc.exe 1848 vlc.exe 1848 vlc.exe 1848 vlc.exe 1848 vlc.exe 1848 vlc.exe 1848 vlc.exe 1848 vlc.exe 1848 vlc.exe 1848 vlc.exe 1848 vlc.exe 1848 vlc.exe 1848 vlc.exe 1848 vlc.exe 1848 vlc.exe 1848 vlc.exe 1848 vlc.exe 1848 vlc.exe 1848 vlc.exe 1848 vlc.exe 1848 vlc.exe 1848 vlc.exe -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 1848 vlc.exe 1848 vlc.exe 1848 vlc.exe 1848 vlc.exe 1848 vlc.exe 1848 vlc.exe 1848 vlc.exe 1848 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1848 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\gothymilly76b779.mp4"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1848