Analysis
-
max time kernel
141s -
max time network
21s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
08/08/2024, 18:56
Static task
static1
Behavioral task
behavioral1
Sample
Monkey Fakee Skip Sample.mp4
Resource
win7-20240704-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Monkey Fakee Skip Sample.mp4
Resource
win10v2004-20240802-en
8 signatures
150 seconds
General
-
Target
Monkey Fakee Skip Sample.mp4
-
Size
343KB
-
MD5
b939a5b557219474abb381366e0e70dc
-
SHA1
cbe8f789e015f291f826a3611a41e0c1fa10976a
-
SHA256
44741b21ec9d87abd99ba339749e3f9e390a6c37a49645957b72d57292882145
-
SHA512
10c9394369b7bc8a8ffa008fd58c6650f08dc0a8646519bb412597875165b5cc20fb7b278f5b50d934bb0594138c64b846b450f695b0e895ea58f7a8064f2d80
-
SSDEEP
3072:0uDXEohS/v0m8m7ciDh83inxpKMgDtz1iu2i4S8P3bUvIoqZG:H4oo/1Ncid83in2M4zEu2i0P3bUp
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2364 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2364 vlc.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: 33 2452 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2452 AUDIODG.EXE Token: 33 2452 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2452 AUDIODG.EXE Token: 33 2364 vlc.exe Token: SeIncBasePriorityPrivilege 2364 vlc.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
pid Process 2364 vlc.exe 2364 vlc.exe 2364 vlc.exe 2364 vlc.exe 2364 vlc.exe 2364 vlc.exe 2364 vlc.exe 2364 vlc.exe 2364 vlc.exe 2364 vlc.exe 2364 vlc.exe 2364 vlc.exe 2364 vlc.exe 2364 vlc.exe 2364 vlc.exe 2364 vlc.exe 2364 vlc.exe 2364 vlc.exe 2364 vlc.exe 2364 vlc.exe 2364 vlc.exe 2364 vlc.exe 2364 vlc.exe 2364 vlc.exe 2364 vlc.exe 2364 vlc.exe 2364 vlc.exe 2364 vlc.exe -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 2364 vlc.exe 2364 vlc.exe 2364 vlc.exe 2364 vlc.exe 2364 vlc.exe 2364 vlc.exe 2364 vlc.exe 2364 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2364 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Monkey Fakee Skip Sample.mp4"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2364
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5c41⤵
- Suspicious use of AdjustPrivilegeToken
PID:2452