Analysis
-
max time kernel
79s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
15-08-2024 00:02
Static task
static1
Behavioral task
behavioral1
Sample
nuclear_bombs.mp4
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
nuclear_bombs.mp4
Resource
win10v2004-20240802-en
General
-
Target
nuclear_bombs.mp4
-
Size
188KB
-
MD5
89a4d69ff3c526730c4fd6c3c8b16cc2
-
SHA1
c5a41e374ce559c402e07eb63f94de7091ef3af3
-
SHA256
eab0cf5d172d9ef0cd49d7c7944be946d95235c634a48b12a4c450eb7f68d657
-
SHA512
c6288a36be86f7593a146f4b385a6389c48bc58b1fafdd32a32a7c710d3360204cb3b902166fad683aa012a409e547394b77aad24290d4a62b07012a50aa4124
-
SSDEEP
3072:WURDsJZX3lZAbWgdAALG96g5ehTtcq6Sm7bsxuTw53Fna6+:IJZlZAbRGALG96g5eHcq6SQk53Fp+
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2764 vlc.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2764 vlc.exe 2184 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: 33 2764 vlc.exe Token: SeIncBasePriorityPrivilege 2764 vlc.exe Token: SeDebugPrivilege 2184 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2764 vlc.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe 2184 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2764 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\nuclear_bombs.mp4"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2764
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:2184
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89B
MD56c608fa3f6b21a99151126c1708e0c24
SHA1ca837ee712ee796dd09a5e873596bc1d2c70fee6
SHA2562e2d28f5045695e22ccc9c34f3596bd7e13f494750a0911a59f4c4f86ba6a198
SHA5125854b5a27d43edd084737ac6c18db0765be85ed64be03b5b9e0cbdcfd93bfbc9cee7f8efbd2336b3660c799751df7211554c05b0222aafa0e3dd9a98fe29343f