Analysis
-
max time kernel
140s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
14-10-2024 03:42
Behavioral task
behavioral1
Sample
cpk/alarm.wav
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
cpk/alarm.wav
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
cpk/cpk.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
cpk/cpk.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
out.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
out.exe
Resource
win10v2004-20241007-en
General
-
Target
cpk/alarm.wav
-
Size
88KB
-
MD5
c9b00535154980ec38e2b4245a638d7b
-
SHA1
4756510665de26e9b72617484f9bb7035d042768
-
SHA256
3a2a723613509787bd44003a8b224e3cbb4746c0d113c426cafba3e73d855cfe
-
SHA512
da62c1c07147c18174bed3a62ffef1f8df2d88619583b0f55d83c23f82a26067f4e575d07e7a8829d6b8ca01a1050a76367cc6ec76be3f1ef21d9ec175db2394
-
SSDEEP
1536:dN5rKQbHywnzhTUN5rKQbHywnzhToN5rKQbHywnzhToN5rKQbHywnzhToN5rKQbs:f5Fj5K5Fj5a5Fj5a5Fj5a5Fj5a5Fj5aM
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2024 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2024 vlc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 2024 vlc.exe Token: SeIncBasePriorityPrivilege 2024 vlc.exe -
Suspicious use of FindShellTrayWindow 19 IoCs
pid Process 2024 vlc.exe 2024 vlc.exe 2024 vlc.exe 2024 vlc.exe 2024 vlc.exe 2024 vlc.exe 2024 vlc.exe 2024 vlc.exe 2024 vlc.exe 2024 vlc.exe 2024 vlc.exe 2024 vlc.exe 2024 vlc.exe 2024 vlc.exe 2024 vlc.exe 2024 vlc.exe 2024 vlc.exe 2024 vlc.exe 2024 vlc.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 2024 vlc.exe 2024 vlc.exe 2024 vlc.exe 2024 vlc.exe 2024 vlc.exe 2024 vlc.exe 2024 vlc.exe 2024 vlc.exe 2024 vlc.exe 2024 vlc.exe 2024 vlc.exe 2024 vlc.exe 2024 vlc.exe 2024 vlc.exe 2024 vlc.exe 2024 vlc.exe 2024 vlc.exe 2024 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2024 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\cpk\alarm.wav"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2024